The HIPPA rules may be strict, but my most frequent breach notification for loss of personal info (averaging once every 2-3 years) is from health insurers and practice companies losing my information.