Don't the British have something like HIPAA in the US? If so PA Consulting would have had to follow those rules when using Google's infrastructure. Google's inf

Don't the British have something like HIPAA in the US? If so PA Consulting would have had to follow those rules when using Google's infrastructure. Google's infrastructure passes many security levels and has just about every security certification (up to but _not_ including ITAR). There's nothing inherently insecure about doing this as long as they follow the rules. What are the rules about this over there?