&gt; HIPAA does require the data to be stored in a secured way.<p>But its extremely unspecific about what that means.<p>&gt; It also requires a certain level of security to get to the data.<p>Less so than you probably think. It has vague high level standards, under which are lower-level implementation specifications (which <i>still</i> tend to be somewhat vague) which may be required or &quot;addressable&quot;, which basically means that organizations are required to review whether they are appropriate; the only technical implementation specifications that are required in the security rule are having unique user IDs and having emergency access procedures.