Patients, advocates and researchers welcome regulations but argue rules don’t go nearly far enough to tackle scale of problem