Exactly. The other issue is people forget that PHI can be used for treatment, payment and operations. You can totally put PHI in your systems literally any sys

Exactly. The other issue is people forget that PHI can be used for treatment, payment and operations. You can totally put PHI in your systems literally any system but you NEED to adhere to the mandated controls specified in your BAA unless you’re a CE. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... Vendors don’t want to adhere to breach notification requirements or actually (gasp) do security which is why they charge you extra just to sign a BAA.