[kevin_morrill]

HIPAA does not have thousands of pages on what and what not to do. It's actually quite vague, and mostly comes down to fines after the fact. There's also no such thing as a government sanctioned HIPAA certification. There's just random people willing to 'certify' you.

[tptacek]

The HIPAA data security requirements are tiny and largely boil down to "data should be encrypted in transit and at rest and require access control".

http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.6.html

[abofh]

Quite right -- a better example is PCI compliance (hundreds of pages IIRC, and several volumes depending on exactly what you're doing; not a law, but similar ramifications if you don't comply);

Still, complying with HIPAA does make one point _very_ clear -- audit controls - Dropbox has none exposed to you, and thus it simply does not comply unless you have your own layer of controls (encryption) on top.

It also seems to fall down under 'Standard: Person or entity authentication' as well, but that's just me being snarky.

Health-care and finance are places with legal (or contractual) obligations -- and that was my main point: if you have a set of rules (or even best practices), and you fall afowl of them, don't go screaming that someone else is to blame.