How about a simple reason to take the incentive to create secure system. Lets start small how about a $10 per record accessed, or a fine equal to the CEO's compensation for a year. Which ever is less.
How about asking the congress to represent the citizens. Are they not the ones that tell are representatives what they want? Not an appointee telling the people what he wants.