This is what I was afraid of. The company I work for has never had to handle this sort of data before, and were VERY close to just dropping all the client info

This is what I was afraid of. The company I work for has never had to handle this sort of data before, and were VERY close to just dropping all the client info into a standard, non-encrypted database. Thanks for your insight. I have a feeling we may hand this project off to someone that is experienced with HIPAA development so nobody gets screwed.