Most health care administrators who put privacy and security and mission above profits will see the long-term value of adhering to standards. If the health care industries aren’t going to demand that those standards for sensitive data be put in place by companies then the job falls to the government (as medievalist describes, bad and good).
Those health care administrators who can’t see past the next quarter or who are (correctly) worried that such standards put us on the slippery slope toward (you’ll forgive the profanity) single-payer universal health insurance will see it exactly as you describe it and resist, since they tend to be the types who are incapable of doing forward planning and smooth rollouts.
[also, while I agree with the quote please edit your post to attribute it to @doctorow ]
