"e.g. any time you mention the word "cloud" the C-level folks yell "but HIPAA!"

I worked for a former healthcare project manager in a completely unrelated industry and I would say 80% of her time was spend worrying about our industry's version of HIPAA. She viewed all new tech projects and software releases through the lens of "How does this violate our industry security standard?". The results were stagnated project releases and high developer turnover.