This is a quantum leap forward for Americans’ privacy rights in the Internet age. For the first time our sensitive medical records will be protected by law. Right now, if you have a medical record, you may also have a privacy problem, but these rules will begin to change that.

I commend the Administration for listening. It appears that they strengthened the rules where justified, and they also took the time to instill flexibility, so that small town doctors and big insurance companies will be able to follow steps appropriate to their different capabilities.

One big improvement the Administration has made is to cover paper files and records, not just electronic files. We do not yet live in a paperless world, and the earlier proposal to cover only electronic records would have left more than three-fourths of our medical information unprotected.

These are carefully crafted rules that Congress was unable to write on its own, but Congress is not off the hook. The next Congress needs to fill in the gaps, especially by giving patients a private right of action to seek remedies when their records are misused. Congress has dropped the ball on protecting privacy, and the new Congress should spend more time on issues like this and less on symbolic exercises that do nothing to improve the lives of Americans.