Totally agree with all of the above - when sysadmins end up in court it isn&#x27;t usually due to HIPAA itself.<p>According to both HIPAA and the major revisions in the American Reinvestment Act (aka Hurricane Sandy Bill), all HIPAA requires is non-cleartext data. It does not recommend or even define a cipher or crypto standard anywhere in the legislation. Legally speaking (IANAL), a zip file with password is fine according to HIPAA since it&#x27;s non-cleartext.<p>So when those admins were in court it is usually due breach of contract (job spec says protect data, follow laws, etc.), heavy-handed tech illiterate lawyers, complete incompetence in hiring the sysadmin, or some other combination of madness - and not directly due to violation of Federal healthcare law.