I'm sure there are auditors who would sign off on it, but you can't really claim that shitboxes prevent PHI exfil. This is like putting up a ten-foot-long fence a mile from the barn with the open door. You lost the battle the moment that data was viewed on any device that wasn't currently operated by a health professional with a reason to see it.