I just wish I could remember why I didn't like them - I clearly do remember thinking to myself, OMG really - you're selling that? There's no security in that model at all.
The biggest thing I would look at - can Citrix look at your stuff if they want to? If you're in a HIPAA setup, you want to make sure you control the encryption keys so they can't look, even if they wanted to.