Providers, states still struggle with HIPAA