In one sentence
Applying the required risk analysis, safeguards, access, audit, and vendor controls to workflows involving PHI.
HIPAA applies to covered entities, business associates, and relevant subcontractors when they create, receive, maintain, or transmit protected health information. Consumer health data can fall under other federal or state rules even when HIPAA does not apply.
A healthcare automation needs a documented risk analysis and safeguards appropriate to the exact data flow. That includes authorized access, audit controls, secure transmission and storage decisions, retention, incident response, and Business Associate Agreements with vendors that act as business associates. A BAA is necessary in those relationships but is not sufficient by itself.
Self-hosting can provide more control, but HIPAA does not impose a general US data-residency requirement and self-hosting does not make a workflow compliant. Connected APIs, messaging providers, models, backups, logs, and support access remain part of the architecture.
Under the current Security Rule, encryption is an addressable implementation specification: the organization must evaluate it through risk analysis, implement it when reasonable and appropriate, or document an appropriate alternative. Audit controls require mechanisms to record and examine relevant system activity; the rule does not prescribe one universal log entry for every automated action.
The minimum-necessary standard is an important design boundary, subject to its legal exceptions. I use my CPHIMS and healthcare IT background to design around these controls, while the customer and its compliance or legal advisers remain responsible for determining whether the final deployment meets their obligations.