>basically every healthcare provider is also a covered entity, unless they're completely 100% cash only and don't take insurance for anyone ever.
This is correct - I should have been more specific. If a business doesn't take insurance then HIPAA doesn't apply. Not that insurance isn't involved in a specific transaction. I've edited my GP comment to be more specific.