Area authorities hamstrung by HIPAA regulations