Medical records are GOLD STANDARD for identity theft, and unfortunately they are rarely protected as well as they should be. In countries where the user pays out of pocket they may even include payment data like credit cards.
As I’ve long said, we will see no change in data protection UNTIL we see some heavy-duty class action and other lawsuits for data leakage. Thanks to the Target leak and now this AG-led lawsuit, we may pass along the pain to the corporations who are responsible for the leak. After all, if your bank got robbed, it shouldn’t cost you anything. And your data is solid gold in this information economy.