HIPAA compliant Anvil app?

Good question. From what I’ve read yes you can but you still bear the risk. I would definitely talk to an auditing agency before you do it. Also it’s not that difficult to get hosting in the US, better safe than sorry.