I must say I'm impressed. It improves substantially on past proposals. Consider the newspaper that receives an anonymous package containing the protected health information of a political candidate.
Computers make it practical to expose hundreds of millions of records as easily as one record.
I fear that the prize of laundering the entire nation's protected health information would be irresistibly appealing to would-be cyber criminals. I further fear that criminal prosecution is insufficient deterrence to groups who already render up members willing to perform assassination for their cause. It comes down to a first amendment issue and the legal approach. To protect against the scenarios I cite, the law must encumber the information itself and restrict all holders in due course regardless of how they came by the information. In other words, we need a prior restraint on speech.