Can CiviCRM be used in a HIPAA context?
Mostly. See

https://forum.civicrm.org/index.php?topic=7788.0

AND 

https://civicrm.org/blog/charlescampbell/civicrm-civicase-ehremr-crisis-response-system

The part about who views records wasn't implemented from within CiviCRM, but depending on the definition of "your personal records" in your context it could just mean page hit tracking from within drupal, since it records the logged in user.