What legal jurisdiction do you operate in? If your USA based, wordpress isn’t ideal for your HIPAA risk assessment as it is a challenge to comply with the privacy/logging requirements. I’m sure people have made it work but might require some heavy customization if you go this route. Likely the same challenge if you are in Europe.