> [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"
My wife is a nurse, and she once made a comment that alluded to this. She said that where HIPAA applies, it applies very strongly. That's why hospital staff, for instance, are always extremely careful about not violating HIPAA. But, she said, it doesn't apply everywhere. Her example was with drug and medical appliance companies who use patient data for marketing purposes.
The key here is in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities...
> [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"