Oh, and Slack is available with HIPAA compliance — https://slack.com/help/articles/360020685594-slack-and-hipaa
Also, as someone who actively shops for SaaS offerings for healthcare users, I can say that AWS and Azure are some of the very, very few organizations who offer anything with HIPAA compliance that isn’t locked away at the most expensive “contact us for pricing” tier. It’s so annoying. Never a chance to try a service with a low cost/stakes pilot/prototype because they hit you with the full sales pitch and highest price points. Being able to dip our proverbial toe into AWS with a low time/dollar commitment was a huge win.
What Microsoft sells is a "good enough" solution that speaks the right language for the decision makers. In turn, this makes their decision less risky while still satisficing the requirements.
If you have an existing business relationship with a company and already trust them to help you navigate regulatory hoops, there's going to be strong inclination to continue to trust them as you expand your infrastructure to the cloud.
Like you said, it's the kind of very smart, long-term marketing I tend to associate with "New"/Nadella Microsoft.
I still don't trust them, but credit where credit is due.
Namely, if you were to state to a higher level manager that you "don't trust Microsoft", you will come across as a crank. Or a developer who doesn't see the bigger picture.
To improve perception, folks should try to reframe their personal preferences ("I don't trust MS") as risks to the business - "I worry that MS will lock us in to their platform and jack up prices". The former is reputation-harming; the latter is being a savvy 2nd order thinker, who looks beyond just what the MS salesman says.
The next one would be the PRISM connection (Skype architecture, etc), and FISA orders they're surely under.
It's not totally they're fault I don't trust them. Buuuuut, it is partly.
Definitely appreciate the feedback - lucky for me, I have removed myself from corporate tech bureaucracy, become self-employed, and can preach from my poor man's pulpit ;D
I'd argue it's less because of a belief that a non-Windows environment is inherently insecure and more that Microsoft very aggressively promotes their products as being compliant with regulations like HIPAA.
This isn't limited to PaaS. For example, I think that Teams will likely gain a foothold in healthcare environments over Slack because MS markets Teams as explicitly HIPAA compliant. (Slack explicitly is not).
Things like that buy them a lot of mindshare when it comes time to choose a PaaS provider.