How can I achieve HIPAA compliance on a DigitalOcean hosted solution?

Let me start by saying this isn’t a trivial ask of a very complex question, I’m already deep into this and I’m looking to see if anybody else has encountered this challenge and perhaps found a solution.

To start off, we have a solution already running on digitalocean and a new client would like to add some data that would be considered Protected Health Information (PHI), which would make us a Business Associate to their organization as a HIPAA covered entity. The general approach here is that we need to get a Business Associate Agreement (BAA) signed by our hosting provider, but DigitalOcean will not sign BAA agreements (Amazon will, but don’t want to go there). I didn’t want to give up, so I did some more digging.

I’ve gone through the HIPAA security requirements and it seems that having a BAA signed by the hosting provider is typically required to cover physical protection of the PHI stored on the hosting provider’s servers. My assertion is that if physical access to our servers cannot provide access to PHI, then we don’t need a BAA signed by DigitalOcean. Has anybody else had to dig into this and come to the same conclusion?

The physical risks I have identified so far include:

1. A system could be shut down and access to PHI limited.
2. A system could be destroyed and PHI lost.
3. A drive could be remove from a system and PHI copied from it.
4. A drive could be removed from a system and security measures disabled.
5. A system could be accessed by somebody at the hosting provider (back door) and data removed.
6. A system could be accessed by somebody at the hosting provider (back door) and security measures disabled.

Any thoughts on risks that might be missing here?

I already have some thoughts on a number of these risks:

1. Our solution has fail over to a different physical location, so covered.
2. Data is replicated in real time to another physical location and backed up off-site.
3. I’m not sure if a drive can be removed and data left intact on the DigitalOcean platform, but I think MariaDB 10.1 with encryption at rest may address this as long as I keep the encryption key off of the server.
4. Remotely check for changed configuration files?
5. Can I assume there is no backdoor into our servers without a signed agreement to that affect?
6. Can I assume there is no backdoor into our servers without a signed agreement to that affect?

If I can build a solid list of risks and mitigation strategies, I’ll pull it together in a DigitalOcean Tutorial and hopefully our shared knowledge and expertise can make DigitalOcean a viable platform for HIPAA compliant solutions.

Thanks in advance for any help you might be able to offer.