Good point. HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them. Mature vendors just don’t w

Good point. HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them. Mature vendors just don’t want to abide by breach notification guidelines which is why they use it as leverage to ask for more $$$.