"The situation is even more delicate when external contractors are involved, such as billing or marketing companies that take possession of patient data in order to perform their duties. Especially in these cases, companies must verify that wherever patient data is stored, on premises,...