I understand your concern, but these days, cloud or no cloud isn't what's important, just that you use a data store in a HIPAA compliant fashion and that the provider will sign a BAA. Health tech startups these days are using AWS, Azure, and Rackspace, all of which will sign BAA's.