Privacy groups say clearer rules are needed for online, patient-controlled health records, but an HHS study of the issue is 18 months late

Congress gave state attorneys general authority to pursue HIPAA privacy and security breaches, but not much has happened