[HarryHirsch]

You'd think they conform to HIPAA, which everyone knows is primarily a shield from lawsuits. As long as you follow HIPAA rules you are immune from liability after data exfiltration incidents. The seemingly inexhaustible amount of patient data on the Interwebs would confirm this view.

[pgodzin]

HIPAA is US only

[HarryHirsch]

Their serviceable address is in the US. That's the shield they are going to hide behind when it's their turn to be hacked.