Yeah. The HIPAA data needs to be encrypted and you have to report everyone who has access and you need patient permission to share. HIPAA is bad, but ITAR violations put you in jail!