I only found out because a colleague spent an entire day maintaining the server we host it on. The notion of having to pay to do all the BS operative work around using that shitty platform is so silly to me. If anything it feels like Microsoft should pay us.

“Private cloud” has always been a synonym for “on-premise”. I’ve managed Datacenter infrastructure for decades and always referred to it to on-premise before private cloud even became a term. It basically is referring to Datacenter space you own or rent vs another company’s servers and DCs.

Hell, I’ve worked in companies where they had Datacenter space in the same building as their office (and not small either, one was 32 racks, another was almost 200). So that very much was “on-premise”

The whole point of “cloud” was to eliminate data centers.

If there was a low latency need for a private cloud, of course you put it as close as possible.

Actual rule: The HIPAA Security Rule focuses on safeguarding electronic protected health information (ePHI) held or maintained by regulated entities. The ePHI that a regulated entity creates, receives, maintains, or transmits must be protected against reasonably anticipated threats, hazards, and impermissible uses and/or disclosures. This publication provides practical guidance and resources that can be used by regulated entities of all sizes to safeguard ePHI and better understand the security concepts discussed in the HIPAA Security Rule.

So at what point can a lawyer say that all the cloud breaches violate the "reasonably anticipated" rule?

There is no certification process in place for using a cloud to store HIPAA data. It even says that on the page that you linked. Legally, any organization that used this service would be opening themselves to further liability under HIPAA.