Right, which is why I don't have any HIPAA-covered data in Dropbox, but my risk assessment does not include "I have Dropbox installed on my machine, ergo, I need to be careful to never access HIPAA-covered info from my machine", which is apparently the level of care I now need for Yosemite. (An upgrade which just got delayed indefinitely, for the obvious reason.)

You're a braver person than I then. I wouldn't download HIPAA data to a machine with Dropbox on it, anymore than I would be downloading protected research data to such a machine. But then, I'm not a doctor so I don't deal with one-off patient info, so it's easy for me to maintain separation.

Though if this is actually a thing that many people want to do, perhaps the new Blackberry OS actually does something that people need...

What does the new BB do?

VMware's vCloud Air does: "To help customers comply with HIPAA and HITECH, VMware offers a Business Associate Agreement (BAA) to all interested customers using our US-based data centers."[1]

[Full disclosure: I work on vCloud Air]

[1] http://vcloud.vmware.com/service-offering/security-complianc...

As will AWS, Rackspace, Google, and a few other providers. (List as of "ones I knew of off the top of my head and could quickly verify via Googling.")

Fantastic, this appears to be changing then, because cloud services have been quite hesitant in the past about this.

> Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA.

That's true of small services, but less so of big enterprise vendor (and, given the size of the health IT market and the big enterprises to serve in that space, that shouldn't be surprising.)

Cloud is almost universally antithetical to any form of privacy, content security, or exfiltration protection.