I shouldn't see why not. Tyk has a pretty small footprint and supports SSL end-to-end so transmission of data is safe. It obfuscates API keys so they can't be pulled if you keystore is compromised and all analytics also use the obfuscated keys so that security is ensured in log data.

However, we'd probably need to do an audit. Worth a check though.

HIPAA pretty much requires dedicated physical hardware. If my code is running on the same machine as someone else's code then I'm breaking the rules.

It appears to be open source and you can download and run it on your own hardware: https://tyk.io/v1.7/download/

Doesn't running in a web browser pretty much mean that?

I feel your pain friend. I too work in the health care industry. Can't use almost any of these toys! Wah!