In my experience, any industry following a security standard halts all effort at security once they're compliant with the standard. HIPAA sets a minimum but seems to also guarantee you will get exactly that minimum and nothing better.

The only thing HIPAA guarantees is that when your data is handed out, there was a policy around it.