For systems you control, yes even if what you've described takes a fair amount of work to get to. The main issue is that for software that wasn't built healthca

For systems you control, yes even if what you've described takes a fair amount of work to get to. The main issue is that for software that wasn't built healthcare first, the strict privacy wasn't a requirement. Retrofitting your software and workflows can be a hell of a lot of work. Add in that you now need to verify that all the vendors you use are also compliant with the terms of your BAA. For most non healthcare first SAAS providers you either do a major rebuild or you end up with a healthcare specific cluster which is missing some of your tools (although it's worth pointing out that many more vendors particularly in the observability space are now HIPAA compliant.)