A lot of times these standards can be satisfied by relatively simple mechanisms like access control lists which prevent legitimate users from performing illegitimate actions (like a nurse or doctor shouldn't be able to pull up any patient record) paired with extra-technological controls like stating that only the listed non-medical personnel can access a particular patient's records (like adding your spouse or parents as valid recipients of test results and health status information). These do nothing to actually ensure the security of the system with regard to external actors.

Additionally, you can often satisfy these things with policy statements rather than technological solutions. A weekly review of record access reports may satisfy in some cases, without needing to implement an ACL mechanism.