Hopeully someone can chime in on UploadCare, but just be aware HIPAA compliance seems to be not possible right now. There are a lot of threads on it
Typically the Signed URLs are generated via a Bubble plugin action (is there a UploadCare plugin?) that uses your UploadCare API token to generate a temporary signed URL for the file