The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
I have read that JIRA Cloud is not HIPAA compliant yet, but what about JIRA Server? (specifically Jira Service Desk)
If the server is behind your firewall, then yes it can be.
Yup would be up to you to configure your controls and validate!