Organizers of health information exchanges must guard against underestimating the amount of time it takes to tackle privacy issues, says IDC's Lynne Dunbrack.