Hacker News Reader

I don't work with HIPAA but with other compliance/regulations NOT using version control is the problem.

Unless you have patient information hardcoded into the source code for god knows what reason...

Things that might be hardcoded are access keys and passwords to PII databases.

Which is bad practice for lots of reasons and, is that a HIPAA violation? Your code also has it then.

Hosting git externally might be an issue though.

No. No no no no no.