Very nice comment. I've worked with HIPAA a bit, and although I'm far from an expert, what you've said is a good summary of what I've done. Secure in flight, secure on disk, secure physical access and hope for the best. We're encrypting our health data in the database as well, for what it's worth.