Since HITECH, all medical records are supposed to be encrypted both in transit and at rest. Reading http://www.courthousenews.com/2013/03/14/55707.htm http://

Since HITECH, all medical records are supposed to be encrypted both in transit and at rest. Reading http://www.courthousenews.com/2013/03/14/55707.htm http://www.courthousenews.com/2013/03/14/55707.htm it seems like the John Doe Plaintiff is a hosting company or datacenter, not the HIPAA covered entity.