Here's a Washington Post story which shows that merely passing a law which makes privacy compulsory is not the whole answer to the problem of maintaining privacy:

The transplant patient was recovering well when doctors discovered that his new heart might have been infected with bacteria before the operation. When the doctors sought more information so they could give the man the right antibiotics, the hospital where the donor had died refused, citing new federal patient privacy rules.

"It was ridiculous. The only live part of the donor was in our patient," said Deeb Salem, chief medical officer at the Tufts-New England Medical Center in Boston.

As it turned out, Salem's patient was in no danger from the infection. But because the donor's hospital refused to release any information, doctors were forced, as a precaution, to put the man on multiple antibiotics, potentially exposing him to dangerous side effects.

"It cost our patient the risk of being on multiple antibiotics for 12 to 15 hours, not to mention a lot of money," Salem said.

Thanks to privacy.org for the link.