What HIPAA regulations are you talking about? Other than HITECH guidance (which can sort-of be seen as a "HIPAA regulation"), HIPAA regulations don't generally specify technologies at all, and I can't think of any that I would describe as outdated or troublesome due to the rise of shared virtual servers and "the cloud", whether they predate it or not.
This is a feature, not a bug. It also is neither HITECH nor HIPAA; it is instead AWS's requirement in order to sign your BAA.
> we can't use ELBs in the standard (easy) way
Also neither HITECH nor HIPAA. ELBs are used in a PHI-related scenario identically to any other scenario. Unless you are referring to using it as an SSL terminator, in which case I would say "the standard (easy) way is always wrong".
There is no, AFAICT, no regulation under HIPAA or related law that requires this. Certain service providers may have determined that they cannot provide guarantees of privacy/security without this technical restriction.
I don't think this meets OP's definition of "wrong".
1) determine what physical hardware in aws the target is running code on
2) somehow get the aws virtual machine manager to let the attacker run their malicious code on the same hardware
3) somehow pierce the protections of the virtual machine to read memory being used by the target application
4) figure out how the data is stored in memory in order to make sense of anything that was read
