My layman's conclusion of HIPAA and cloud hosting was that the language of the law was vague and technologically out of date, and that depending on how you interpreted its requirements you'd be either OK or OMGWTF noncompliant.

It's too bad because the medical space is in dire need of innovation and there's a lot of money to be made.