Because HIPAA can be enforced by state attorneys general and not just the feds, risk managers should study any interstate connections that could come into play if there is a privacy breach...