Yep and covered entities are usually related to billing for medical care. As an example, almost all life insurance companies are not even hipaa compliant becaus

Yep and covered entities are usually related to billing for medical care. As an example, almost all life insurance companies are not even hipaa compliant because they aren’t covered entities. In net - hipaa doesn’t protect medical information generally - only the subset that’s usually visible to doctors. And even then, it stops working as soon as the info is outside a covered entity.