Interoperability rule exposes gaps in protecting privacy