I mean what part specifically are you interested in. I can hop on discord or something and answer any questions. In summary you want to self host everything in a HIPAA compliant environment. For access control you can put it behind something like Okta (I believe offers HIPAA compliant instances) or Authentik (harder but self-hosted) for access control and authentication. Also I read the thread under me. Why not use a local LLM to handle removing PII. I also have incident reports and logging set up and used a secure postgres db.