On: IRS faces class action lawsuit over theft of 60 mi...

[bhousel]

Since HITECH, all medical records are supposed to be encrypted both in transit and at rest.

Reading http://www.courthousenews.com/2013/03/14/55707.htm it seems like the John Doe Plaintiff is a hosting company or datacenter, not the HIPAA covered entity.