Narrator: "But it did neither."

Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME.

Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.