Totally agree with all of the above - when sysadmins end up in court it isn't usually due to HIPAA itself. According to both HIPAA and the major revisions in t

Totally agree with all of the above - when sysadmins end up in court it isn't usually due to HIPAA itself. According to both HIPAA and the major revisions in the American Reinvestment Act (aka Hurricane Sandy Bill), all HIPAA requires is non-cleartext data. It does not recommend or even define a cipher or crypto standard anywhere in the legislation. Legally speaking (IANAL), a zip file with password is fine according to HIPAA since it's non-cleartext. So when those admins were in court it is usually due breach of contract (job spec says protect data, follow laws, etc.), heavy-handed tech illiterate lawyers, complete incompetence in hiring the sysadmin, or some other combination of madness - and not directly due to violation of Federal healthcare law.