Thought experiment: if I were to take some medical records and XOR it with a one-time pad, then stored the result somewhere not HIPAA compliant, would that be illegal? How about if instead I stored the one-time pad somewhere not HIPAA compliant?
It would seem a little strange if one were illegal but not the other.
It would seem a little strange if one were illegal but not the other.