Waving the bullshit flag here...

HIPAA compliance completely fucks with your network infrastructure.

Case in point, from personal experience: I used to work for F5 Networks, who make (among other things) the finest load balancer in the world.

For those who don't know, a load balancer takes traffic coming in from the internet, and directs that traffic to the appropriate servers within your network.

Since load balancers are facing the direct onslaught of all internet traffic coming to your domain, they are attacked almost constantly by hackers (not hyperbole... literally multiple times PER SECOND), who are trying to gain access to the internal network services.

So your load balancer (or ADC) needs to be SUPER robust to deal with all these different attack vectors.

The smartest and best way to defend against most attacks is to have a "full proxy" load balancer.

This means that traffic coming in from the internet is completely decoded and disassembled, then, on the other side of the load balancer (your network side) the packets are reassembled and passed along.

This decoding/rebuilding of network traffic removes about 95% of the potential attack vectors hackers can use.

HOWEVER...

Because a full-proxy load balancer decodes the incoming packet, HIPAA regulations say you cannot use this type of load balancer, due to patient privacy concerns.

They say that decoding internet traffic at any point between the server and the client is a breach of patient privacy, and is therefore forbidden.

This is what happens when government tries to regulate technology.

The reality is that, inside the load balancer, the ENTIRE PROCESS happens within code on a chip, and is never, at any point, in any way, accessible to anyone outside the box. Not the administrator, not the hackers... nobody can ever possibly see the unencrypted data.

But no... if you have a full-proxy load balancer, then you are breaking HIPAA regulations.

(Sorry. I get a little worked up about this shit. The government is technologically illiterate, and should be prevented from making ANY technology decisions. See: Apple vs FBI for more examples of government morons at work.)