I recently went through setting up a HIPAA compliant web app. The team is small and has no dedicated DevOps so I went looking for a PaaS solution. After extensive researching and trialing, I went with Healthcare Blocks. They provide a great experience and were the only company that offered a sane price point for an early stage startup. Honorable mention to Aptible, especially their Gridiron product that we will eventually use.

I think another viable route is hiring a contractor to build out your environment for you. We got a quote from an AWS contractor and it was reasonable for our setup, but ultimately we really wanted a PaaS. Unless you’re an expert in HIPAA and the cloud platform you’re looking at, it’s not something I would recommend tackling on your own.

Remember that there are a lot of non-tech parts of compliance to consider as well such as training, physical security, security assessments, etc.