HIPAA compliant Anvil app?

No you still need an auditor to inspect Anvil’s servers.