I’ve seen this movie before. A few years later someone will figure out that this data that was supposed to be “private and encrypted” was being sent out to Microsoft, who will get a slap on the wrist, half assedly apologize and immediately move on to even more anti consumer ways to squeeze more income out of its users for “growth”.

I’m not saying that won’t happen but if it does Microsoft will be absolutely fucked as they got caught committing several million HIPAA violations, not to mention any exposure to classified material on government computers.

Consumer PCs are almost certainly not covered entities under HIPAA, nor is Microsoft in its role as an OS provider.

Even then, if this whole thing were to result in an inappropriate disclosure by a covered entity, the organization that processes the data would be liable, not Microsoft.

That’s like blaming the building contractor because you left the door unlocked and someone came in and stole your cat.