I've become a great fan of HIPAA since being dragged kicking and screaming into the corporate world, because "we need to devote some time to protecting our users' privacy, because not doing that would be irresponsible" does not move The Powers That Be, but "we need to devote some time to protecting our users' privacy because HIPAA" does, The Powers That Be not caring about all about doing things right if it costs them money but caring quite a bit about avoiding legal troubles. I like regulations that force The Powers That Be to let me do things closer to right. Without them I have to lie a lot... I hated it when I worked at a nonprofit, when we only had to pay attention to it when it turned out to proscribe something strictly inferior to what we planned to do.