I'm assuming your referring to HIPPA, I could be wrong, however, health laws cover one fundamental function. That is the analytical compliance in which it's intended purpose was developed. Measuring its economical success can be evaluated by its social impact. For example, HIPPA, although covers many informational concepts of protection, its primary purpose is regulatory compliance through regulated agencies for the simplicity of governing human behaviors, information systems, and controls for HIT access. for example, one could measure the information system through risk analysis for determining their risk compliance within HIPPA's scope.
If there is anything else you need clarifies, please let me know.