The laws are, the policing is not. At least not in medical data