[mannyv]

Nothing in HIPAA mandates air gaps. In the context of HIPAA that's really overkill.

In fact, self-hosting might even do you wrong when things go bad, because AWS is probably better managed and more secure. And they have all their certs, which is legally important.