No disagreement. Its just something I point out when people are concerned about "HIPAA compliance."

My experience is that people tend to think its some objective level of security. But its really just the willingness to sign a BAA and then take responsibility for any breaches.