HIPAA-Regulated Data: Any application that stores data, even temporarily, on third-party infrastructure not managed by UB or Box, is forbidden for HIPAA-regulated data if no BAA is in place with that ...