Well said! Just to add a few more points. On the technology side you want to make sure you have data encrypted "at rest" and "in transit". i.e. At rest means t

Well said! Just to add a few more points. On the technology side you want to make sure you have data encrypted "at rest" and "in transit". i.e. At rest means things like running AES encrypted drives for your DB data storage. AWS has docs & case studies on this and is HIPAA compliant. Just don't use RDS, it isn't HIPAA compliant yet.