HMAC is a cryptographic algorithm which makes sense as part of bigger protocols; you should not fiddle with it directly. When you use HTTPS, the SSL layer actually includes some HMAC (among other algorithms).
OAuth is a standard for authorization whose main use case is managing authentication of users without sharing credentials -- the idea being that one user could have credentials (a big word for "password") known to a single server, that can be used to be granted access by several other servers without trusting them enough to show them the actual password. Say, servers S and T trust authentication server A, user U also trusts A enough to show it his password (within some HTTPS connection), and S and T talk to A to make sure that user U is indeed who he claims to be; the nice part is that S and T never see the password and U needs not trust them.
In your case, you have a single "user" (your server H) and since that's a machine, it needs not be picky about his password; H can have a "password" (a long sequence of random characters) which H will use only to authenticate with O, so there is no need for the extra complexity of OAuth.
The inherent vulnerability here is that server H has access to the sensitive data. That's by design, but this means that the data makes it to an hosted server, which implies that you trust the hosting service for not peeking at your data or leaking it through carelessness. You cannot evade that, as per your problem definition. You basically consider server H to be safe, by itself, from eavesdropping and hostile alterations. Under these conditions, HTTP's "Basic" authentication run within HTTPS will be fine.
You might want to tighten a bit server authentication: machine H will need to make sure that it talks to the genuine O server, which normally entails certificate validation. You can configure H to make "direct trust", i.e. import in H a copy of O's certificate (just the public certificate, not the private key), and instructing H to trust that specific certificate and none other. This may avoid issues with Certification Authorities, and, in particular, allows for safe usage of self-signed certificates, which are cheap (since you don't have to pay a CA for such a certificate).