This is correct. We ran a website for diabetics where users volunteered health data and HIPAA didn't apply to us. If it coordinated data exchange with doctors directly then it would be different.
What about doctors using an iPhone to check a patient's files? Would apple have to make a secure HIPAA compliant version for hospital use? What about government use? I bet all those FBI agents are talking to each other with iphones...