Google for this phrase: HIPAA violations in the news

I get 172,000 hits.

Here, read it. You'll be surprised.

http://www.rdmc.org/cmhc/reports/HIPAA_Security_4.pdf

They are not really standards, just vague suggestions. For example:
"Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity."

Ummm, how long? Is a week alright?

"Implement policies and procedures to protect electronic protected health information from improper alteration or destruction."

and my favorite:
"Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate."

And so on.

Hard to take these "standards" too seriously. Very subjective, vague, open to interpretation. Not really standards. Simply saying: "require passwords" or "have a backup plan" is not useful.

My two cents:

Worked for a law firm ten years ago. IT, LAN manager, sys admin, help desk, information officer, palm engineer, etc.

Every one of the senior partners (there were 8) felt that he was my sole manager. They all felt they knew more about IT than I did. They routinely countered each other, sometimes just for spite. Huge, puffy, bloated egos. Lots of SHOUTING and panic'd staff - stress was so high that you could literally smell it. Politics. One told me to convert their 1.2 million WordPerfect legal documents to MS-Word and gave me two months and no budget. They burned through IT people like lamp fuel. The geek before me lasted a year as a stress junkie and got cancer.

Absolute hell job, TOXIC. Quit after three weeks and good riddance.

I know, every business is different, etc, etc, but I have heard similar stories from other law firm sys admins. These people eat their own. Meet their families, I think you'll agree.

The Three Envelopes.

IT manager starts a new position.

All goes well for a few weeks, then something big breaks. Lots of pressure. Rooting around in his desk, he finds 3 envelopes. The first is labeled "Open at the First Crisis". On a whim, he opens it and the note inside reads "Blame it on your Predecessor". He decides to take this advice and to his surprise, it works like a charm, management is satisfied, he is given time to fix things.

A few months go by and a something much bigger breaks, seriously disrupting operations. He is in trouble. At his desk, he decides to open the envelope labeled: "Open at the Second Crisis". He'd been saving it for something big, and this is it. The note inside says: "Form a Committee to Study the Issue". He does just that and, to his surprise, it works great. The committee wastes time and accomplishes nothing, but blame is diffused.

A few years go by. The third and final envelope is labeled: "Open at the Third Crisis". He thinks about opening it many times, but he waits, saving it for a real disaster. One day, it comes. Catastrophic failure. He takes a deep breath, tears the envelope open and inside, finds a note that reads: "Prepare Three Envelopes".

(I liked this story so much that I left a set of envelopes behind at one job.)

More likely: Win7 = Vista 1.1

Either way...