HIPAA isn’t really that bad. If you’re following normal good security practices at your company you’re probably at the point where becoming complaint is more about implementing a bunch of small mostly meaningless changes to your infra and documenting stuff than some fundamental change to your architecture.