having gone through many hipaa audits/reviews both as customer and as vendor, in my experience when contracts are being signed/renewed it is much more about the people and processes involved.<p>never had any customer ask specifics about encryption algorithms, apis, dev stack, tooling, or key managment. ("do you encrypt data at rest?" "ok, check.") i wish they would. we spend a lot of time and effort on those decisions.<p>had lots of requests about hr policies and procedures, ongoing perimeter scanning and network intrusion detection, data loss prevention, patching process, hids, data destruction logs, physical security, breach notification plans, disaster recovery SOPs, and other stuff you would find in various NIST and FISMA specs.<p>but maybe that's how it should be...smart, experienced people will more often than not make good decisions and use the right tools for the job (whether easy or hard) and be vigilant and introspective. give inexperienced folks the best/easiest tools in the world that dont require them to understand the details underneath, and they can find clever ways to create huge gaping holes. and if they are looking for the easiest path, they are probably not well equipped to handle all the unknown unknowns that invariably pop up (usually friday late afternoon!)<p>honestly, i prefer to know my stack(s) intimately from the kernel sources up, and know how to evaluate and react to potential problems at all layers, than simply outsource all responsibility for these issues to someone. (ok I outsource some pieces, but only when it makes the solution better, not just easier.) ymmv.<p>also, fwiw, never had a breach from outside ... but had numerous incidents of employees who have lost or stolen laptops which just happened to have a sql dump of "test data". human error/laziness gets you every time.<p>still, good to see options evolving in the market! the more educated buyers become, the better questions they will ask! and the more rigorous vendors will get...we hope :)