[tptacek]

For what it's worth, accidentally (or even negliently) violating HIPAA is fantastically unlikely to get you charged criminally.

[cperciva]

I agree -- but fraudulently violating HIPAA (e.g., if you advertised "this is a safe place to put your HIPAA data" while knowing that it wasn't safe) is probably a rather different matter.

[rbranson]

Yeah but "0wning" EC2 would most certainly get you charged criminally under a number of laws.

[tptacek]

Colin was implying that negligent management of EC2 could leave Amazon employees criminally liable. Obviously anybody who "owned up" EC2 is already a criminal.