"Until at least several audits have been completed, and the industry sees action taken to enforce the HIPAA security rules, I think serious attention to compliance will not be a major focus," he said.

However, it isn't just enforcement by the HHS that health-care providers and other organizations handling medical data need to be concerned about, said Peter MacKoul, president of HIPAA Solutions, a US-based firm that offers tools and services to help companies comply with the law.

MacKoul said that increasingly, law enforcement authorities and courts are using and interpreting HIPAA in ways that could have broad implications for organizations handling health-care data.

For instance, the US North Carolina Court of Appeals overturned the decision of a trial court to dismiss a HIPAA-related complaint brought by an individual against a psychiatrist's office. The verdict basically allowed the plaintiff to use HIPAA as "a standard of care" to bring an individual action against an organization, MacKoul said.

In addition, he noted that HIPAA initially applied only to electronic medical records. But, MacKoul said, courts have extended the law to cover paper records as well — a fact that some health-care providers may not be aware of.