The HIPAA Enforcement Rule looks pretty vague to me, but then, I'm not a litigator. What's really interesting is learning that enforcement is passive: wait for the complaint to come in, then investigate. I have to say I'm really happy the meat industry isn't regulated that way. But then, food poisoning is a matter of life and death; having your identity stolen merely makes your life a living hell.
Oh wait, I forgot. The meat industry's regulators don't do much better. So if you happen to be the unlucky type, you could get your identity stolen while you are in the hospital being treated for necrotic enteritis caused by Clostridium perfringens hanging out in your steak tartare. I think it would be fair to call that a bad day.