> Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules? Only if the doctor does not accept any insurance payments at all

> Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules? Only if the doctor does not accept any insurance payments at all (ie, from other patients). If they're "in network" with any insurance provider, they're generally required to abide by HIPAA for all patients. It's possible to get around that, but most independent providers aren't going to bother, and neither are larger health systems. Smaller practice conglomerates (e.g. the for-profit startups you see advertising on social media) are the ones most likely to be be taking advantage of this. The main other case where you see this come up is outpatient therapy or psychiatry, because providers in most other contexts are not 100% self-pay, but many mental health providers are 100% self-pay. > it would mean that HIPAA isn't just weaker than people think, it's extremely weak. HIPAA is extremely weak. It's better than nothing, because the few protections it gives are important, but it's nowhere near sufficient.