content: There’s BAA agreements for HIPAA related content stored in the cloud to protect against this sort of thing. Besides, HIPAA content is stored in an EMS/EMR such as Epic and has it’s own protected cloud storage, but outlook is usually used for communications where the agreements are needed. As far as I know, most policies don’t allow FERPA or HIPAA content in the cloud due to possible connections to home computers and liability of data breaches.