I believe this is out-of-date. Our healthcare startup has passed in-depth security reviews from multiple huge carriers, and we operate in the cloud and use tons

I believe this is out-of-date. Our healthcare startup has passed in-depth security reviews from multiple huge carriers, and we operate in the cloud and use tons of open source. (We're hiring Rails devs!) It is a meaningful effort to be HIPAA-compliant, that prevent us, for example, from using lots of cool SaaS services. The bigger issue for us is that each integration still has customizations associated with it, because of a lack of agreement about what fields mean.