We aren't yet HIPAA compliant (yet), we recently got SOC2 compliance working with a compliance vendor to do more certifications. One thing is that with our on-prem agent your customer data never leaves your VPC.