What about HIPAA?
Your app runs on your infrastructure and your accounts, so protected health information stays inside your control — I don’t host patient data on my systems. Projects that touch PHI get built with access controls, audit logging, and encrypted storage, and I work with whatever business associate agreements your practice requires.