The first company that gets to a certified HIPAA and PCI hosting cloud is going to have to figure out what to do with the buckets of cash they have lying around. I think for the enterprise PCI certification will be the event that gets the big (non-tech) guys out of running their own infrastructure. I would imagine that it would be the same for medical. As for you immediate question, I am sorry I can't help I don't know who if anyone is doing this. I am still looking for a PCI certified cloud as a portion of my customers are Public companies and not having to work on all their different infrastructures and being able to provide them a hosted solution would be great for me, but there is no way I could get into managing a PCI certified hardware infrastructure just to achieve that goal.