Considering a service allows for the communication of PHI without persistent storage.
If the user takes responsibility for storing their own data, and they choose to store it in their google cloud storage, would this be an acceptable under HIPAA?
A user wants to send a message to another user.
The service establishes an encrypted connection directly between their two devices. The server stores only contact information and no PHI whatsoever. The server does not participate in the communication once the connection is established and does not even forward the messages. (It would be helpful to know if the service might be in violation if the servers did in fact forward the messages).
The data is stored, encrypted, on each user's devices.
If that encrypted data is then stored on a third party cloud storage service, like iCloud or Google drive, then would the service be in violation of HIPAA?