The sales weasels don't care whether the product does the right thing, they care that the customer thinks the product does the right thing. The pointy-haired boss doesn't care that the product does the right thing, he cares that his ass is covered and he has something to brag about to his pointy-haired boss to prove he has Leadership. Your users care in the abstract, but aren't really interested; if they're told all is well, they'll take it on faith because they just want problems ancillary to what they're trying to do to go away. If you care about your craft or your users, you pick fights with your pointy-haired boss and the sales weasels so you can do whatever it is you're trying to do right. Dominant species or no, PHBs are easier to replace than you are, you can get away with saying "fuck that, here's what we're going to do" as long as you're right. Or you let it grind you down and just do whatever you need to do to keep the PHB smiling, but that'll make you miserable.
Or, if you don't care to write your own HIPAA-compliant EHR for your staff-of-five and client-base-of-hundreds, you accept that the whole thing is a big stupid pigfuck but that it's everyone's big stupid pigfuck and move on. It's like speeding on the freeway - if everyone's doing it, the likelihood of being pulled over is proportional to the redness of your car and personal ethnicity, not proportional to speed. HIPAA, in many ways, is the exact same boondoggle as the Americans with Disabilities Act. 10-20 percent of my audio budget used to be for Assistive Listening Devices because the ADA says you have to assume that 5% of the audience for any given public event is deaf, and you need to provide them headsets, minimum 5. Which means if you have a classroom that seats 20 people, you have to have headsets for 25 percent of the seats. Which means if you have a stadium with 20,000 seats, you've got 200 headsets in a closet somewhere. Which nobody adhered to. Even the building inspectors knew it was a joke. They wanted to see the regulation "six headsets and an emitter" on every spec sheet because they knew it would never get used. Commtek, Genter, Listen Technologies... these are companies that exist to make devices no one will ever use because of legislation. When HIPAA went through I got to start putting in masking systems for every lobby in every medical office. HISSSSSSSSSSSSSSSSSSSSSSSS