>but the sensitivity and security required for dealing with healthcare data
I'm curious why you think this. Disclaimer I have worked for a cloud based EHR system as well as a HIPAA compliant mobile/web app. We haven't had any issues with sensitivity or security, (obviously following best practices). A password on a physical computer only goes so far, I would venture to say that our systems are *more* secure than a desktop app.