I was the sysadmin for a small medical practice for a while. Patient privacy was the one reason I was (and remain) dead se against storing practice medical records on the cloud.

If anything every got out, I would have been liable. I fully accepted that. But I had full control.

If anything stored in the cloud ever got out, I still would have been liable, but I wouldn't have had any control. For sure, the cloud storage provider would have disclaimed liability and I'd still be the man on the spot.