HIPAA does not forbid e.g. Patrick from viewing or working with medically sensitive data. If it did, it would effectively prevent any medical software or servic

HIPAA does not forbid e.g. Patrick from viewing or working with medically sensitive data. If it did, it would effectively prevent any medical software or services from operating at all. HIPAA does however have an awful lot to say about what can and cannot be done with this data, how it must be handled, who it can and cannot be divulged to, and so on. For example, when and where it must be encrypted, how its use must be audited, etc. It is in some ways like PCI compliance. All parties handling sensitive medical/financial data on your behalf have to follow certain secure practices, or risk facing steep fines and legal action.