Second, the rules that govern what companies need to keep and can throw out started changing dramatically — witness the recent Sarbanes-Oxley Act, new rules from the SEC and NASD, privacy requirements based on the Health Insurance Portability and Accountability Act (HIPAA), and increased oversight from federal, state and local agencies.