I think GP was saying roughly "IM provides a means for encrypted communication, including the transfer of files. By HIPAA, we have to prevent the transfer of files containing patient medical information. The firewall can't distinguish among that encrypted traffic in order to PERMIT text chat but PREVENT all file transfers, thus the ability to transfer files securely via IM is an exploit as far as HIPAA is concerned."