That's not true. They only need to be HIPAA compliant if they're a covered entity and dealing with an HHS related transaction. https://www.hhs.gov/hipaa/for-p

That's not true. They only need to be HIPAA compliant if they're a covered entity and dealing with an HHS related transaction. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > A Health Care Provider .... ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.