Hypothetically speaking, imagine if a rogue Amazon employee bypassed the normal access restrictions and got physical access to your S3 storage media. They would have access to your cleartext data. There are various unfortunate scenarios that I could think of that might put your unencrypted data at risk of exposure. This is why S3 encryption at-rest is a very good idea if you feel your data is at all sensitive. By not encrypting at-rest, you are basically giving absolute trust to any individual who comes in physical contact with your data. You should trust nobody.
With that said, if you truly are dealing with sensitive data being stored in S3, you SHOULD NOT be transmitting this data in the clear at all. If you want to truly be as secure as possible, you should implement client-side encryption of the data, before it is ever sent to S3. On top of this, I would use TLS encryption of the connection to S3. At this point, your data in encrypted before it ever gets to S3, and you can optionally decide whether to turn on S3 server-side encryption for yet another layer of encryption, because why not? It's free to do so, right?
I'll admit I'm not a HIPPA expert - it's not something I personally have to deal with, but I do understand the nature of securing sensitive customer data. If you are in a position to be responsible for such things, then I don't know why you wouldn't default to using the most layers of security possible. Only trying to do the bare minimum is how companies end up in the news headlines due to "unexpected" (negligent) data leaks. Don't be the person responsible for bad news headlines for your company. Secure your sensitive data as much as possible, and certainly as much as is required.