" HIPAA is both good and bad , " said Devon Herrick , a senior fellow and health economist at the National Center for Policy Analysis , a non-profit advocacy group in Dallas , Texas , that researches public policy .