Thanks for the TrueVault pointer, that's a great resource for info! I was going to followup asking your thoughts on using their service vs doing it yourself, but reading the dev guide posted by @jameslk I came across this:

    We think this comment from Hacker News sums up the technical debt required to roll your own HIPAA compliant infrastructure quite accurately. This was completely unsolicited and is not from a TrueVault customer.
    
        "[Building our own HIPAA compliant infrastructure] took upwards of 1,000 person-hours to figure out HIPAA-compliance issues. This will continue to be an ongoing cost for us, because HIPAA is an ongoing law and it changes sometimes. It takes substantial auditing time and money." — jph