State policies improving data protection are especially important for increasing adoption of health IT and health information exchanges.