Would this use of patient data just affect AC-Cloud docs? How would AC be able to use data that was not on their servers?
At the end of the day, cloud users are at the mercy of the hosting company. You can have agreements until the cows come home, but if you don't have physical security of your data, you don't have any security. This is also why gaining access to the database, even if only read-only is important. If an Evil Empire takes over AC, you need to be able to cut the internet connection, get help from a third party, and export your records in a form you can at least read.
