I think HIPPA is a great example precisely because it goes beyond "don't disclose this", it also regulates "safe storage requirements", whose purpose is ultimately to make unwanted disclosure (through breaches, rogue employees, etc.) less likely, of whatever scale. (e.g. my plaintext password for a service shouldn't ever be disclosed to even a single person.) I think we're in agreement about people generally expecting professionalism.