You can fit an astounding number of elephants through the loopholes in HIPAA: https://www.law.cornell.edu/cfr/text/45/164.512 https://www.law.cornell.edu/cfr/t

You can fit an astounding number of elephants through the loopholes in HIPAA: https://www.law.cornell.edu/cfr/text/45/164.512 https://www.law.cornell.edu/cfr/text/45/164.512 And then there's the HHS interpretation of the above for providers, which is... porous: https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... Of particular note are the exemptions in 45 CFR 164.512(k)(2) applicable to powers granted by executive order 12333 (on mass surveillance). When this exemption is used it makes discovering whether, when, how, or why your data was collected or used practically impossible.