Huble Digital has built HIPAA compliant CRM extensions in HubSpot for several clients.
A CRM Extension is shown in the right hand side margin of a Contact/Company/Deal record and looks like it is part of HubSpot, but it is actually an external system.
We build these on a single tenancy HIPAA compliant hosting environment, and lock them down to a IP range.
Most of the information cannot be used in lists as it then can be identifiable - but we work with customers to identity what can be put into lists without breaking PII rules.
Reach out to me here for more info: https://www.hubledigital.com/meetings/daryn-smith