HIPAA compliance has nothing to do with encryption, and little to do a traditional tech sense of privacy/security. If you handle patient information, encrypted

HIPAA compliance has nothing to do with encryption, and little to do a traditional tech sense of privacy/security. If you handle patient information, encrypted or otherwise, you are subject to compliance hurdles (with the exception of extremely-limited-scope entities treated as "conduits", but the policy does not distinguish between ciphertext and plaintext when it comes to PHI). Fax, email, SMS, etc are all (fairly explicitly) within the realm of things subject to BAA for compliance. HIPAA (and a broad swath of other tech legislation) is not necessarily indicative of actual security. For example, HIPAA-compliant hospitals are currently seeing a rash of ransomware attacks; any meaningful definition of computer security would include defenses against these kinds of things. HIPAA is domain-specific policy with a poor understanding of the domain. That's (in no small part) a bilateral educational failure; technology makers don't understand policy and policy makers don't understand technology.