Yes, exactly. And when someone tries to sue you out of existence for improperly handling patient data, responding with "Improper handling? We don't handle it at

Yes, exactly. And when someone tries to sue you out of existence for improperly handling patient data, responding with "Improper handling? We don't handle it at all!" is a fantastic defense. You might piss off whomever your contract is with when you tell them you've been deleting data instead of storing it, and there may be grounds for a different lawsuit. But they can't say you're not HIPPA compliant. [0] [0] I don't 100% know the specifics of HIPPA, so I'm not sure if this would really apply, because I know you need to keep detailed audits and logs of various things.