. . . "Employers, insurers, and other institutions which do business in or have employees in multiple states, may have difficulty determining which standards apply for information obtained, stored, transmitted or used in different states." .