Google will sign a BAA for pretty much anything other than analytics. There's a decent market for HIPAA compliant analytics services, especially for analyzing marketing funnels, conversions, etc.
I haven't a clue if either of those companies do, though it wouldn't surprise me if they did.
URL (gets redirected): https://healthy.kaiserpermanente.org/consumer-sign-on
If one had a list of patient portals[0], what would be the simplest way to check each for 3rd party trackers? Use Selenium?