From what I've gleaned from my social worker/therapist house mate is that you're not supposed to be storing any of that data on a non-compliant device to begin with. They can't keep anything local, and use some portal to a company that specializes in HIPAA storage.

I agree in general though, there are plenty of documents that really shouldn't be suddenly dumped to the cloud