The RIAA has an actual law (however absurd that law may be) on their side to award damages.[1] HIPAA has no such law, they can fine health companies for failing to maintain privacy standards, but there is no right to individual tort.

It's worth noting that the largest HIPAA fine to date was $3mm -- .001% of the sought-after amount.

(http://en.wikipedia.org/wiki/Digital_Theft_Deterrence_and_Co...)