> At some basic level treat it like HIPPA or medical data

HIPPA is an extremely very poor model for this sort of thing. It's just this side of worthless in terms of maintaining medical privacy. It's actually very difficult to maintain the privacy of your medical data in the US.