HIPAA compliance doesn't mean anything unless they're willing to sign a BAA with their customers' organizations. Perhaps they're signing BAAs now, but in the recent past (~6 months ago), I asked and they weren't signing them.