Agreed. Anyone that you choose for HIPAA-compliant hosting should be able to outline their policies. Where I work at Catalyze, ours are here:

https://catalyze.io/hipaa/ https://catalyze.io/policy/

And we've gone through a HITRUST audit to validate these claims:

https://catalyze.io/compliance/