HIPPA is a law that governs how people and companies within the healthcare system in the US are allowed (and required) to handle, protect, and share data. It was definitely needed, and rectified a lot of bad practices - health care providers were really very sloppy and cavalier about handling data - but even with that limited scope, it’s very complicated.

It doesn’t cover anybody else. Yes, health information SHOULD absolutely be protected more stringently so that OTHER major players can’t abuse your privacy, but that wasn’t the focus of HIPPA.