Given your HIPAA environment, Canonical's products leave you doing more to harden the system down for compliance versus another distribution which could be hardened by default and leave you to open things up to your needs when creating the standard image.

In the end, your the one that has to justify the decision and if you've hardened it appropriately then who is one to judge.