The Regulated Customer: Retention, HIPAA and Residency

A healthcare customer wants to use the Claude API with patient data. What can they use, and what has to change?