[travisp]

That would have nothing to do with HIPAA. HIPAA generally only covers patient information held by health providers, payers, etc. It only applies to "covered entities", which is a specific set of entities. It's a myth that HIPAA applies to health information generally. There's even dispute about whether or not HIPAA applies to doctors and medical services who don't accept insurance ( https://www.lebauerconsulting.com/hipaa-is-my-cash-practice-... )

(although some states have more strict health privacy laws)