Did you look into Microsoft Service Trust portal? Specifically Compliance Manager Classic. It contains bunch of compliance and regulatory framework templates(HIPAA included) and clearly defines what is needed to make sure that your Office365 is compliant. All of the requirements are divided into 2 groups: Customer(Your) Responsibilities & Microsoft responsibilities.
