Wave it all you want, you're wrong.

All the technological stuff you're talking about gets totally swept under the rug. Having sat next to five sales presentations, whenever you mention HIPAA compliance they all say "we got this and can protect you" and the conversation moves on.

I'm not saying these vendors are HIPAA compliant - I'm saying they're diffusing the question their customers are asking effectively be that through misunderstanding, half-truth or outright deception. Either way, individual practitioners get to check off the HIPAA box without having to know or care what a load balancer is. They mash an icon on their iPad and they're in, and their clients click a button on their website and they're in.

So get worked up. Take a stand. Pontificate about encoding. Between the pointy-haired bosses and the sales weasels, you're not only irrelevant, you're a deaf-mute because you won't even be asked. I'll take it further - you could walk into any independent practitioner's office with a white paper and server logs demonstrating that a doctor's EMR isn't HIPAA-compliant and they'll shrug, say "I got my waiver" and tell you to leave.