I worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. They sign BAAs with hospital systems promising to anonymize and provide analytic services to them. While doing so they “pocket” the raw data. Data that is pilfered to these digital healthcare startups is never coming back or erased. HIPAA is too weak to cover these scenarios. Adding insult to injury a lot of these startups have developers in other countries handling confidential patient information.