I don't think this is the case. Last I read up you are personally liable for HIPAA violations. If you do something, knew it wasn't something you should do, and

I don't think this is the case. Last I read up you are personally liable for HIPAA violations. If you do something, knew it wasn't something you should do, and refused to fix it, stuff gets really bad. To stay safe with medical data, however, you basically just need to hit whatever standard you think is reasonable. There's no established standards other than: 1. "PII" encrypted during storage/transfer. 2. Customers can request a download of their data. 3. Customers can request you delete ALL their data. 4. Fast track sec fixes above all other company goals.