We were building a HIPAA compliant app a few years ago. OSM looked like a good option and fit a lot of our requirements. Then I looked into actually using it and ran.

To me, it seems like there's a huge opportunity for OSM or a third party to run a managed OSM instance.