It looks like there's a third-party product built on top of Dropbox that is HIPAA compliant: http://techcrunch.com/2012/07/15/dropbox-tigertext-announce-...