I also work in the healthcare space with heavy HIPAA security requirements. Like any language/framework/platform there are best practices to follow for solid security and performance, and a good secops team should set meaningful requirements.
In short, I will show a "This site requires Javascript enabled" message 100% of the time if my site requires Javascript.