Does the HIA apply to non-digital systems like pen-and-paper setups?

Yes, even clinics using pen-and-paper systems are required to comply with HIA guidelines, as data protection requirements apply universally.