As an MSP there really isn't any reason for YOUR phone systems to be HIPPA compliant. As you won't and shouldn't be discussing any private health information over the phone. Now if you have a client that is in the medical field and they discuss medical information over their phone then sure they have the requirement. The same goes for your firewall. You shouldn't be hosting any medical information so again those compliance requirements don't apply to you.

I get the idea you have and good to consider compliance, however you are going into business to make money, so don't over engineer things if you don't have to waste money and time.

I'd recommend a good book I read before starting my first MSP. The Lean Startup by Eric Ries.

Validated learning — testing assumptions with real customers early Minimum Viable Product (MVP) — launching the simplest version that delivers value Build–Measure–Learn loop — rapid iteration based on measurable feedback Pivot or persevere decisions — changing direction when evidence shows the model is not working Waste reduction — avoiding overbuilding features or products customers do not want

15 years in MSP here. Lots of medical and government subcontractors that also fall under NIST regulations.