In a sense the name says it all: HIPAA's about Portability and Accountability, less about security.

I worked on a few security consulting projects in healthcare. The HIPAA security rule is way more vague about actual controls than a rational person would assume; much more than analogous regulations on financial data (e.g. PCI-DSS). The HITECH amendment added a lot of breadth regarding which parties must comply, but did little to proscribe specific controls. Most providers, contractors, etc. use a framework called HITRUST that attempts to identify and map actual security controls to HIPAA, but even that is not super actionable.

One of the hardest problems to solve is the immediate criticality of patient data. You absolutely cannot have someone die because a nurse or doctor forgot their password and couldn't look up medical history. Makes practitioners resist adoption, and you end up with "break the glass" (emergency security bypass) functionality on a lot of sensitive systems/data.