You dramatically misunderstand VPC. Everybody on AWS today uses VPC, unless you happened to be grandfathered in to EC2 'classic'. There is NO COST to using VPC (aside from admin over head maybe?). It's a huge security upgrade, as it gives you the ability to isolate things much better.

The specifics of HIPAA/HITECH compliance on AWS are available under their BAA (which is confidential), and do require some things that cost more money. VPC is not one of them.

If you have only a quarter rack of servers and want the minimum s for physical security, yeah, you can probably make that work cheaper than AWS. When you have a whole datacenter worth of gear and now need a more sophisticated security / entry system, etc. the argument becomes much closer.

With that said, you misunderstanding how VPC works and what it is makes me wonder if your pricing is coming out right: it's really complicated to price out a full AWS cost, just as much as to price out your own costs.