So whether you're a covered entity or not is an important factor to consider because it might or might not force you to be under HIPAA.
The main article:
https://www.dpcfrontier.com/hipaa
HIPAA Forms:
https://www.aafp.org/pubs/fpm/issues/2003/0200/p29.html
HIPAA infractions:
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
Security Asessment Tool:
https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool
Are you a covered entity test?
Does HIPAA apply to free clinics?