Can technology innovate beyond legal parameters? Consider HIPAA privacy and security rules that address access to confidential data: for example, $($a$)$ the Privacy Rule with regard to accounting for disclosures; and $($b$)$ the Security Rule with regard to audit trails, access controls, and validation. These rules address legal parameters $($e$.$g$.,$ must have means to account for disclosures, etc.$)$ but do so in the context of the technology used at the time the rules were promulgated.