[MattGrommes]

I don't know about the wording of the law but in the actual implementations I've done it does provide a measure of privacy and accountability. HIPAA-compliant companies are required to keep your data from being seen by anybody you haven't allowed to see it and for like the programmers working on the HIPAA system who might be exposed to your data you're required to not provide raw access to the data and keep a auditing log of who saw it and when.