It seems like Apple's interest in health data is an important part of their unusual concern for user privacy. The less secure the phone, the more problems they'll have with something like HIPAA.
Not really - I don't see a way in which any of Apple's statements or motions with regard to user privacy have any implications for HIPAA compliance.
HIPAA is a really arcane law, and it actually largely wouldn't even apply to the sorts of stuff being discussed here, because HIPAA doesn't cover anything that happens after the user receives the data. Broadly speaking: if it's encrypted in transit, once it reaches the phone, it doesn't matter if the phone is compromised or not; that wouldn't be a HIPAA violation either way.
But since HIPAA doesn’t apply to what patients do with their own data that is not as applicable. For example, if I add my medical record to Dropbox and it gets hacked, that isn’t a hipaa issue. But if my doctor puts my medical record in Dropbox and it gets hacked it is and either my doc or Dropbox have to handle the breach notification per hipaa.
https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...
Unfortunately, HIPAA is an incredibly rigid, incredibly broad law, and it's applied to a field in which security practices are incredibly inconsistent.
As a result, HIPAA violations are pretty commonplace, and the vast majority are never reported to HHS, let alone penalized.