tldr: Yes and No: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... There

tldr: Yes and No: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... There's a lot of nuance. Put simply, HIPAA is not required to be applied to a cash-based transactions. HIPAA is dependent on health insurance (and in-turn the government's influence on health insurance). Most healthcare providers accept/rely on insurance, so they simply choose to follow HIPAA standards. An entity can be a "hybrid" entity, in which they explicitly seperate define HIPAA-compliant and non-HIPAA compliant parts of their businesses. Most providers don't go to this effort since (1) it does introduce risk (accidental intra-org boundary breaking) (2) most of their systems of going to be HIPAA-complaint anyways (3) they're not in the business of selling healthcare info. I'm getting a bit fuzzy at this part of the law, but I believe that HIPAA only applies to transactions "for which HHS has adopted a standard.". That means even within health insurance transactions, there are legal carve-outs. Realistically, the US needs far stricter health-privacy laws.