HIPAA is easier than PCI. PCI involves not only concrete technical controls, but also a for-profit bureaucracy.

Neither are particularly meaningful from the POV of software security.