I don't work with HIPAA but with other compliance/regulations NOT using version control is the problem.

Unless you have patient information hardcoded into the source code for god knows what reason...

Things that might be hardcoded are access keys and passwords to PII databases.

Which is bad practice for lots of reasons and, is that a HIPAA violation? Your code also has it then.

Hosting git externally might be an issue though.

No. No no no no no.

You're not storing patient details in VC...... Right? Maybe show him that you can run svn even on his own machine... Anything... Anything is better than not using something

I've work with HIIPA and VC. No issues, as long you do not store patient information within the source code, I cannot think of any reason why you would need to do that...

I work with HIPAA and SOC2, this is ridiculous. Your boss is misinformed.

Just show him that you're literally only committing code, and not any real data in the repo.

I worked at a place that is extremely concerned with HIPPA to the point of having many specialist lawyers. We were required to use version control.