[CWuestefeld]

Certainly HIPAA is far more trouble, and every example I can think of, of regulation being passed in haste in response to witch hunt, has been awful. I'm thinking of stuff like Sarbanes-Oxley or Dodd-Frank. Neither of these did much in terms of their stated goals, but they have created a bunch of problems as unintended consequences.

[EpicEng]

> being passed in haste in response to witch hunt

We hear about new attacks and vulnerabilities, more credit card numbers stolen, more personal information stolen, on a weekly basis. I think we're past the point of accusing legislators of acting in a reactionary manner to an isolated incident or two should the proposition of regulation be put forward.