Made up rules aren’t law.
"Made up rules aren’t law."
Especially when they seek to expand the scope of the actual law itself beyond patient privacy.