HIPAA compliance doesn't mean anything unless they're willing to sign a BAA with their customers' organizations. Perhaps they're signing BAAs now, but in the recent past (~6 months ago), I asked and they weren't signing them.

Even if they sign BAAs, that doesn't mean that every health organization is willing to go off-prem. On-prem is popular for a reason.

Yes, absolutely. Good point.