The EU and the United States have implemented data breach notification rules that cover
the health sectors. Nevertheless, data breach incidents involving medical data continue to
rise, especially in the US and the UK. The HITECH Act, Pub. L. 111-5 Title XIII is the first
federal health breach notification law in the US to be characterized by less government
intrusions, while the revised EU Privacy Directive, 2009/136/EC calls for tougher privacy
protection for data held by electronic communication providers. While the EU law sets
a global de facto standard, the law remains toothless without strong enforcement
mechanisms.