This can be changed, regardless of whether any of us is ready to throw up our hands about the whole situation as it stands.

Look at health records. HIPAA is rather successful at keeping your health data narrowly confined to those that need it. There is nothing that prevents similar laws to work for financial data, location data, etc.

The only roadblock is people saying they “don’t personally think legislation is the answer”. Because there is literally nothing but law that can have an effect.

The sales director for a drug manufacturer knows that you’ve filled a prescription before the claim is filed.

Enfamil and Gerber knew the estimated due date of our baby — although the only interaction we had with anyone was a miscarriage at 8 weeks and a near fatal complication.

I agree that HIPPA is technically very weak.

But let's also agree that preventing gossip about private health info is a good thing -- a definite step in the right direction.

Laws are about building and reinforcing the culture we want to build. In that light, HIPPA is a long way from a failure: it sets the standard that "health care privacy is to be taken seriously, and as a society we believe it is important enough to legislate", if nothing else.

Are you sure it wasnt something like this?

See, for example, GDPR.