So, that's an interesting question, right? If it's UK data, from the UK .gov, being stored to a server whose hardware is in the US, to be worked on by a UK con

So, that's an interesting question, right? If it's UK data, from the UK .gov, being stored to a server whose hardware is in the US, to be worked on by a UK consultancy, should it actually be subject to HIPAA? Jurisdiction in the Internet is tricky business.