They have to use Amazon's VPC service - AWS has a 'secure' vpc service where you don't share the server with other customers which is a requirement for HIPAA compliance. That service gets really pricey.

I run a similar service but for SMS messaging that is 21cfr11 compliant. We rent a 1/4 rack with our own door/lock and throw in pretty much disposable servers as needed. It's much cheaper than doing the equivalent on AWS, and it's not that difficult to set up your own secure servers once you have a few recipes to follow.

We started it about 9 years ago before a secure service with amazon existed. Every year or two I price alternative solutions like AWS's secure service, VPCs, etc and it's always cheaper even taking account my labor to stick with our 1/4 closet. In fact, it seems they base their costs on the going rate for rack space, plus a premium for using the convenience of using their servers.

Oh, and it's funny - we have almost the same number of users and we're processing more messages per month than them, all on a old-fashioned webserver-appserver-dataserver arrangement - three servers (with fallover redunandancy not counted) and it's barely breaking a sweat.