[petee]

From what I've gleaned from my social worker/therapist house mate is that you're not supposed to be storing any of that data on a non-compliant device to begin with. They can't keep anything local, and use some portal to a company that specializes in HIPAA storage.

I agree in general though, there are plenty of documents that really shouldn't be suddenly dumped to the cloud

[orev]

The point here is that you might have a system that is compliant, but then MS pushes this and suddenly it’s uploading data that you thought was safe.