The server is in someone else's building. They have hippa compliant stuff for healthcare, but at a point there is just that risk that you have to take with the

The server is in someone else's building. They have hippa compliant stuff for healthcare, but at a point there is just that risk that you have to take with the servers and data not physically being entirely under your control and having to trust the providers