Compliance involves encryption at rest and in transit and with cloud providers making sure you only use HIPAA compliant services, getting BSA’s with external contractors, minimizing who is allowed access to data, etc.

It’s more complicated than this but this is a good overview.

https://www.hipaajournal.com/hipaa-compliance-checklist/