Although non-compliant activity with regards to e.g. spreadsheets containing patient data is extraordinarily widespread [+], you're correct, putting a spreadsheet with PHI on iCloud (whether you intended to or not) is a reportable breach.

(Not a lawyer, but I have to care about this, for professional reasons.)

[+] Say, emailing in the clear about PHI. This is extraordinarily common even among people who theoretically know better.

From what I can tell, I think a lot of people in healthcare view HIPAA as poorly written, and more or less a bureaucratic obstacle to doing their jobs effectively. Part of it also is that all the EMR solutions are so terrible that to try and do patient care entirely within a given EMR is so painful, people do the dropbox/email route to get around their limitations.

Are organizations that are caught emailing PHI in the clear not punished for this? Or are the damages insufficient to change the behavior?

Yes.

Odds of an enforcement action are minimal (940 complaints for Security Rule violations in 5 years divided by one sixth the economy), given that enforcement is complaint-driven and CSV files rarely complain. If you're big enough you budget for fines like retail budgets for employee theft -- sure, don't seek it out, but you won't be heartbroken when it happens.

My experiences on this suggest that any company that both produces something classifiable as PHI and large enough to have dedicated IT / Legal staff have fairly draconian policies that include "every attachment that is mailed to a mail server that is not ours is stripped".

When individuals work around these policies, there tends to be some level of legal shielding for the larger business entity when it is investigated.

Very expensive. I'm flagging our security.

Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA.

And anyone working with data under HIPAA had better know this already!

Right, which is why I don't have any HIPAA-covered data in Dropbox, but my risk assessment does not include "I have Dropbox installed on my machine, ergo, I need to be careful to never access HIPAA-covered info from my machine", which is apparently the level of care I now need for Yosemite. (An upgrade which just got delayed indefinitely, for the obvious reason.)

You're a braver person than I then. I wouldn't download HIPAA data to a machine with Dropbox on it, anymore than I would be downloading protected research data to such a machine. But then, I'm not a doctor so I don't deal with one-off patient info, so it's easy for me to maintain separation.

Though if this is actually a thing that many people want to do, perhaps the new Blackberry OS actually does something that people need...

What does the new BB do?

VMware's vCloud Air does: "To help customers comply with HIPAA and HITECH, VMware offers a Business Associate Agreement (BAA) to all interested customers using our US-based data centers."[1]

[Full disclosure: I work on vCloud Air]

[1] http://vcloud.vmware.com/service-offering/security-complianc...

As will AWS, Rackspace, Google, and a few other providers. (List as of "ones I knew of off the top of my head and could quickly verify via Googling.")

Fantastic, this appears to be changing then, because cloud services have been quite hesitant in the past about this.

> Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA.

That's true of small services, but less so of big enterprise vendor (and, given the size of the health IT market and the big enterprises to serve in that space, that shouldn't be surprising.)

Cloud is almost universally antithetical to any form of privacy, content security, or exfiltration protection.

Mavericks had the same behaviour as Yosemite iirc, except it was less obvious.

in Mavericks default save location was iCloud for docs but it didn't silently upload stuff afaik

It actually did upload stuff silently. Here's what you can do to reproduce:

Have TextEdit enabled in the iCloud System Preferences panel. Open TextEdit, create a new document, type stuff in it. Now press cmd + O to display the iCloud document picker, and you'll see your new document got uploaded to iCloud, without you ever hitting Save or explicitly agreeing to save it on iCloud.

The only way on Mavericks to have 100% local data was to:

a) disable Documents in the Cloud for all apps or a specific app, or:

b) save documents to the local drive immediately after creating them, before typing anything.

I'm surprised this isn't more commonly known, and that everyone seemed totally fine with it. Doesn't seem like intuitive or expected behavior for an average user IMO.