You'd think they conform to HIPAA, which everyone knows is primarily a shield from lawsuits. As long as you follow HIPAA rules you are immune from liability after data exfiltration incidents. The seemingly inexhaustible amount of patient data on the Interwebs would confirm this view.