When Microsoft and other companies try to fight copyright infringement, they essentially made the law that "making the product available" constitutes the infringement. It doesn't matter if anyone has actually downloaded the copyrighted material or used it in any way that might be illegal, the fact that the product was "made available" is a violation of the law and implies under hefty statutory damages without the owner needing to prove any damages. The corporations were successful at crafting the law that punishes such the behavior of sharing and essentially makes an individual who shares go bankrupt.
How would the same principle of overzealous punishing for "making available" work in the proposed case of personal data and DRM? Actually very simply. Only in this case the health care provider is the one who potentially "makes available" the personal data. Just as it doesn't matter whether the downloaded copyrighted material has ever been played/installed/used, the fact that it was made available is punishable. With personal data, once anyone's data is "made available" it would be irrelevant if it was used or misused, the mere fact of making it available should be punishable. And I don't mean a small fine. I mean jail time for those who approved the decision, the architecture, or made errors in code. As it is difficult to impose the same severity punishment that individuals face for sharing onto a corporation, it should be either a corporation to go bankrupt or responsible people going to jail. What will happen if such law gets passed? Since many executives will not like to end up in jail for proposing a stupid solution, the silly ideas will die out. So, if some provider decides to implement Microsoft's solution with DRM and an error in Microsoft DRM causes the data to be leaked, the Microsoft executives would face felony charges for not providing the appropriate safeguards and making the data available. Yes, I mean, you, Craig Mundie would become a felon! I completely support such a reciprocal implementation of the law.