In the United States, a “constitutional analysis” of medical data privacy has been so far unsuccessful in obtaining significant protection. Statutory protection has evolved primarily to protect the citizen against the state, not to vindicate the privacy interest of the individual. A “consumer protection” approach rather than a right-to-privacy approach can be used to develop a coherent, practical approach to the needs of various parties in the health care system in the United States.