Anyone who isn't in health doesn't need to be HIPAA compliant, and thus isn't likely to do so.

That means that pretty much every possible service that is commonly used is off-limits. JIRA is an especially frustrating, but not entirely uncommon, example: to get them to sign a BAA, you need a massive contact.

That means no bug reports can go into JIRA with anything resembling the actual bug other than very vague info, so your internal customers (i.e. clinicians and customer service) have to jump through extra hoops just to file an issue.

I would love a world where HIPAA level compliance was standard for all PII across all industries. Until then, people will keep making mistakes.

Imagine this: you have two websites, a marketing site and a separate subdomain for your actual "app". There's a login button on the marketing site that redirects the user to the subdomain login page. Marketing adds GA to the marketing site to track conversations.

Congratulations! You've just violated HIPAA, because the rules apply to "past, current and future users" meaning that Google could theoretically identify people who were interested in either creating an account or wanted to log into your website. "But our company has a BAA with Google! We use all sorts of their products, right?" Wrong! Analytics is the one essential business software that Google refuses to cover with a BAA, which alone should tell you why you ought never browse the internet without uorigin and co.

I'm not making excuses for anyone. This is really important stuff to understand. It's also not always entirely obvious just exactly how leaky the entire SAAS world is to business people making what, in any other job, are obvious decisions.