Do you have experience building sites that meet HIPAA compliance?

I recently recieved a request from someone asking about using MODX for a project that would need to follow the compliance guidelines and regulations under the [url-http://en.wikipedia.org/wiki/HIPAA]US HIPAA[/url] ACT. If you have worked on a site or project that would be covered by the act it would be great if you could share your feedback and experience. What pitfalls and gotchas were there? We’d love to know.

Thanks,

Jay