I have been doing contract development for a software company that sells 2 different EMRs (acquisition nonsense) that together own over 30% of their market. Both products were started by practicing physicians that wanted a product better suited for their specialty.
In my view HIPAA is not your biggest concern.
From a cost to build standpoint you are likely to spend a lot of time on Meaningful Use certification, ICD9/10 support, and the nightmarish integration scenarios with 3rd party lab providers, electronic prescription services and drug databases. There are answers to all these things, but if you come from a technology background other than healthcare you might be in for a shock at just how dated some of the “industry standard” solutions are.
It’s also not a one person effort. An EMR system is much more than an appointment/contact manager on steroids. It’s not the kind of thing you can build on top of WordPress and get 2/3 of the way there. Just the work involved to feed the billing system is noteworthy. Add in the fact that software mistakes in critical areas can kill someone (ex: drug interactions) it’s really important to get some parts perfect - zero tolerance for bugs.
All that said, it can be both lucrative and rewarding. If the doctor is willing to stay engaged and fund it for a few years, it could be the opportunity of a lifetime.
One other note, if you talk to 10 different doctors you’ll yet 10 different versions of how everyone does it. Make sure your test group includes more than just the sponsor’s practice and more than just doctors. The biggest EMR users are nurses and office support staff.