HIPAA compliance is not some unacheavable data security standard. It's so basic that probably all industries should follow it. The problem is that it's surrounded in verbose policy-speak so it just looks completely opaque. There used to be a table on the HHS website that gave a concise explanation of the rules. It's things like what PII is, that it should be encrypted at rest and in transit, how to get explicit permission to transmit it, authorization and authentication is required for viewing the data, and there must be an audit log. Having worked in the financial sector this is all basic stuff.