I don't think it's a big deal necessarily. First, "HIPAA Compliant" is mostly a marketing term as there is no certification, like for things like PCI. The main

I don't think it's a big deal necessarily. First, "HIPAA Compliant" is mostly a marketing term as there is no certification, like for things like PCI. The main point of HIPAA is having policies in place that help prevent the unauthorized disclosure of PHI and track/trace authorized disclosure for auditing purposes. To make these policies effective you often need a BAA signed with vendors that can receive/store PHI, and many/most SaaS/PaaS companies are unable to do this. More details: http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.html http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.h...