A few comments:
1.. The encryption requirements of the Act are not new nor are the complexities of sharing and reading encrypted data; years ago I worked on XKMS which did not succeed in solving the problem of key management.
2. The article suggests that:
Fraud involving stolen patient healthcare data, primarily Medicare/Medicaid identity theft for making money off submitting fraudulent claims, is not uncommon…..
I think the major difference between stealing credit card numbers for fraudulent purposes is that in the case of credit card fraud, the victim is the unwitting individual who was scammed. The victim of a medicare fraud is the government who is responsible for reimbursing the health provider.