I can tell that you don't work in healthcare, or with janitors, or you'd know that they need to know most of this stuff.

It's the janitors that have the keys to everything. It's the janitors that know which bins go to the sanitation department and which ones go to the secure shredding company. It's the janitors who walk around the building at night and notice if someone's left papers on their desk after they went home (another one of those four-alarm-fire events), or a computer didn't lock itself, or someone dropped an access badge, or something else is amiss that could cause problems.

there’s no doubt a firehose of “anonymized” marketable data going out the door.

Please specify how it is that "there's no doubt." Do you have some evidence, or are you just being a cynic because that's the way anonymous wannabe cool kids act on the internet?

If you have evidence let me know, and I'll hook you up with our department that handles this sort of thing so they can take a look at it.

How did that happen? How did they know?

Well, each doctor’s flow of prescriptions is sent to an aggregator in near real-time, sometimes before the pharmacy gets it. That’s how they know to offer Dr. A a trip to Vegas and Dr. B a sandwich.

Hospital admissions, OB admissions and doctor fees are events that get sent to insurers for payment and subrogation. These vendors are allowed to “anonymize” (aka remove name and SSN, etc) and sell that data.

So you can buy marketing lists that contain, by zip code, addresses with inferences about medical conditions, events, and other metrics. I bought the list and discovered three pregnancies with projected due dates, 6 Type-2 diabetics, 2 people getting married in the next 6 months, etc on my block. And two babies were born, as projected.

There is a difference between compliance, privacy and security. The controls that I’m sure you’re diligent in implementing don’t address many privacy issues. HIPAA was enacted in the 90s and doesn’t address the risks today.