Admins and moderators can already edit user profiles unless disabled within CB > Configuration > Moderation. Users could just login and view their profiles as normally. CB however is not tested for HIPAA compliance and do not recommend using it for medical record keeping unless you absolutely understand how to modify/configure it for HIPAA compliance.