If you are interested in some studies on HIPAA compliance, I would suggest reading the work by Dr. Annie I. Antón on requirements engineering.

http://www4.ncsu.edu/~aianton/

HIPAA is seriously complex piece of legislation.