Neither approaches the secrecy needed by government installations. Health care and banking leak PII regularly and never really suffer any consequences.

Healthcare and banking have no issue storing data in third party datacenters as long as they meet the applicable standards.

You absolutely don't need this or FedRAMP to do healthcare.

i'll add that on-prem is getting 10-100x easier than it was 10-20 years ago (still very hard), and "i want to run this in my own datacenter" is becoming accessible to much smaller companies than just F500 enterprises

Both of which are encumbered with regulations that want them to need this.