I think their point is that it gives you a relatively stable env, and allows you to be the one deploying and configuring infrastructure. Anything that can be miscommunicated to client on-prem deployment staff will be, in a lot of cases breaking guarantees like HIPAA compliance.
That's just nitpicking
Not really.
So much of HIPAA is actually getting the administration right.