So whether you're a covered entity or not is an important factor to consider because it might or might not force you to be under HIPAA.

The main article:

https://www.dpcfrontier.com/hipaa

HIPAA Forms:

https://www.aafp.org/pubs/fpm/issues/2003/0200/p29.html

HIPAA infractions:

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

Security Asessment Tool:

https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool

Are you a covered entity test?

https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/Downloads/CoveredEntitiesChart20160617.pdf

Does HIPAA apply to free clinics?

https://www.americares.org/wp-content/uploads/globalassets/_snc/eduresources/practicefacility/hipaa/2.-hipaa-faqs-may-2014.pdf