No. HIPAA only covers (applies to) certain entities like hospitals and insurers, not the USPS. And there’s an explicit “conduit exception” that allows covered e

No. HIPAA only covers (applies to) certain entities like hospitals and insurers, not the USPS. And there’s an explicit “conduit exception” that allows covered entities to distribute protected health information via non-covered entities such as the postal service. The FTC regulates the privacy of sharing personal data including health info by entities not covered by HIPAA, such as personal health apps. So if a govt agency wanted to investigate this, it would probably be the FTC using basic privacy laws. HIPAA wouldn’t apply. (IANAL, just have a fair amount of experience with HIPAA & HITECH) Edit: Added more details.