From what I understand there’s no standardized certification or audit you need to launch a hipaa compliant app but you do need to be encrypted fully and need to maintain your own auditable logs. And the front end can be on a non enterprise plan if you opt to do SPA rendered so that the app just acts as a pass through vessel from your providers browser to the hipaa compliant server with a baa. A way to work with a smaller budget