An ever changing area of privacy can often involve state law. California is moving quickly on several bills right now in this area including:
A.B. 370 Amending California Online Privacy Act (CalOPA) for disclosures on behavior tracking.
S.B. 46 Amending Notification Requirements for Breaches of User Names or Emails in combination of passwords or security questions and answers that allow online access.
S.B. 568 Expands Federal COPPA to all Children under 18.
The HIPAA rules are also subject to change, as the industry, technology and risks change. What might have been "unreasonable" a few years ago for covered entities to provide protections to data may be "reasonable" protections today or in the near future.
If you need help understanding HIPAA rules on privacy, please contact Kinney & Larson.