It seems unclear is a PBM is actually required to be HIPAA compliant. It's possible some health care providers (think large hospitals) enforce HIPAA via contra

It seems unclear is a PBM is actually required to be HIPAA compliant. It's possible some health care providers (think large hospitals) enforce HIPAA via contractual obligations without federal law directly requiring PBMs to be covered entities. That would give a path for GoodRx to interact without being in violation of HIPAA.