Luckily, we don't deal with patient records or related PHI; which lowered concerns to the "BAA is sufficient" level. If I was running an EMR or such, I'd want

Luckily, we don't deal with patient records or related PHI; which lowered concerns to the "BAA is sufficient" level. If I was running an EMR or such, I'd want the servers in a colo, with gated physical access, and contracts signed in blood of the each person's firstborn :)