Patient records are, indeed, protected by law. They can, however, be reviewed by several agencies, if they are investigating a physician for wrongdoing. One of those agencies is the DEA.

Our records will be highly encrypted and stored in a secure database. I'd like to maybe get a server offshore - not in the US. I think that's probably ideal.