Over-applying and misapplying HIPAA is common