We're fully HIPAA-compliant, as Tyler mentioned in another comment. Data is encrypted, and isn't stored on the device. HIPAA (and specifically MU Stage 2) is actually more helpful for what we are doing than anything else; letting patients get access to their records electronically is a hugely important step towards solving major problems in the health industry.

In what way? The technical aspects of HIPAA are pretty straightforward (although a lot of work), and it appears the user is in control of who can see their data.