Thanks to some help I think I got a grips on HIPAA. Let me know what you think.

HIPAA:

Relevant for all data which is PHI & PII: Example: Johann (PII) has a broken leg (PHI).

PII: Personally identifiable Information

PHI: Protected Health information

PHI relevant data has to be:

1. Encrypted at rest
2. Secured in transit
3. Only accessed by people needing to access the data 

Implications:

1. Encrypted at rest:

PHI data needs to be encrypted at rest in all stages and systems.

• Salesforce:
  • Shield Platform Encryption in SF
    • Not for Big Object / External Object
  • SF Standard field encryption -> Small number of PHI
    • Only certain custom fields
    • Not files
    • Can’t bring your own key
• Privacy Shield in Heroku
• DWH needs to be HIPAA compliant
• Shield for Einstein Analytics, not available for EA plus

2. Secured in transit:

• Mutual SSL on integrations (e.g. SF to ESB)
• NOT: Emails (Cannot be encrypted unless specialized tool like Data Motion)
  • Ask cust. to log-in. 

3. Only accessed by people needing to access the data

-> Everything private, only open up what's needed

Other implications:

• Data masking in full copy sandbox needed to protect data from testers .
• Anonymized/dummy data in Dev Sandboxes
• Anonymized (global) reporting if necessary/possible