HHS, which under the execrable Obamacare law gets to make its own rules, has decided that it will not be required to disclose any security breaches, even to the people whose information is stolen.
And security breaches are a virtual certainty; recall that the system was deemed too insecure to go live, but went live anyway, in violation of government rules. Indeed, they’ve happened already.
Internet Scofflaw 