[jauer]

I've seen things much worse than this with medical records and data.

Up to a few months ago we had a ASP.NET shared hosting customer that was doing some kind of data relay web service for medical imaging. No encryption. Patient data in full view on the server. No redundancy. Apparently it was used for outsourcing imagery review or something. If it didn't work doctors would have to drive in from home which slowed down the diagnostic process.

"Mission critical" on a $30 a month shared hosting plan. Very much not HIPPA compliant.