I was wondering if this could be trivially adapted to be done over elliptic curves
If you don't mind the plaintexts being confined to points on the curve (as opposed to elements of $\mathbb{Z}^*_p$), then it's easy; pick a key $k$ that's relatively prime to the curve order $q$ (easy to do if you pick a curve with prime order), and then:
$$Enc_k(P) = kP$$
$$Dec_k(P) = (k^{-1} \bmod q)P$$$$\begin{align} Enc_k(P) &= kP\\ Dec_k(P) &= (k^{-1} \bmod q)P \end{align}$$
Now, if you can't live with that restriction, one obvious possibility would be to use a curve with "twist security" (e.g. Curve25519), and so if the curve order is $q$, and the twist order is $q_T$ (note: $q$ and $q_T$ are the order of the curves, not the prime subgroups), then,
$$Enc_k(P) = kP$$
$$Dec_k(P) = (k^{-1} \bmod q)P\ \ \ \ \ \text{if P is on the curve}$$
$$Dec_k(P) = (k^{-1} \bmod q_T)P\ \ \ \ \ \text{if P is on the twist}$$$$\begin{align} Enc_k(P) &= kP\\ Dec_k(P) &= (k^{-1} \bmod q)P&&\text{if P is on the curve}\\ Dec_k(P) &= (k^{-1} \bmod q_T)P&&\text{if P is on the twist} \end{align}$$
Curve25519 point multiplication can be done only using the $x$ coordinate, and so we can treat arbitrary values between 0 and $2^{255}-19$ as points.
Now, this construction preserves some of the properties of PH (for example, $$Enc_a(Enc_b(M)) = Enc_b(Enc_a(M))$$ but not others, for example, the question that was recently askedquestion that was recently asked about combining two keys into a third that had $Dec_c(Enc_b(Enc_a(M))) = M$; that doesn't work as well; we can't define a $c$ that'll be able to decrypt both messages on the curve and messages on the twist (and giving someone both would allow them to potentially recover the values $a, b$)
