People generally don't die as a result of failure to meet HIPAA standards, though. To boot, HIPAA covers security standards for the protection of PII--it doesn't cover security standards for network intrusion.

Preventing network intrusion seems pretty critical to protect PII.

Someone can be on the network and fail to crack encrypted data and you'd be in compliance. HIPAA is only about information leaks, not about operational health.

A lot of times these standards can be satisfied by relatively simple mechanisms like access control lists which prevent legitimate users from performing illegitimate actions (like a nurse or doctor shouldn't be able to pull up any patient record) paired with extra-technological controls like stating that only the listed non-medical personnel can access a particular patient's records (like adding your spouse or parents as valid recipients of test results and health status information). These do nothing to actually ensure the security of the system with regard to external actors.

Additionally, you can often satisfy these things with policy statements rather than technological solutions. A weekly review of record access reports may satisfy in some cases, without needing to implement an ACL mechanism.