The HIPAA data security requirements are tiny and largely boil down to "data should be encrypted in transit and at rest and require access control".

http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.6.html