As someone who most recently worked in product at a healthcare startup I found the most difficult thing about innovation in the space is the cost of compliance/regulation. When you work in an industry that is so highly regulated, and assuming you are working at a company that follows the rule of law, how do you actually "disrupt" a set of problems in this industry when there is so little wiggle room for doing things…
I'm pretty sure email can be HIPAA compliant as long as you implement the system using the established guidelines.
Source: Not a lawyer, not your lawyer. Sign off provided by non profit bio research orgs lawyer before I set it up.