I have actually read HIPAA - the Health Insurance Portability and Accountability Act of 1996. People assume it means "health records privacy," but it is not exactly that.

HIPAA has several provisions. It was passed as a tax bill. It created Health Savings Accounts (or Medical Savings Accounts -- whichever one came first). It also created a whistleblower provision to report fraud in Medicare.

The part that people refer to is the confidentiality (which is either Part C or Part D -- been awhile since I read it).

That part says that "covered entities" must not disclose patient records information to anyone not authorized to see it. This part of the statute is directed at (a) health care providers and (b) health care payers (insurance companies and Medicare) for the purpose of exchaging patient records information for medical billing purposes.

It is not for any other purpose. This was 1996, when computers were becoming a "thing" and they wanted to pass a law that would protect patient records sent electronically the same as if they were sent by mail.

There might be some other law regarding privacy of medical information (and I assume there probably is), but HIPAA is not it. Unfortunately.

Don't try to rely on it to assert any rights, because it will not apply in most cases -- unless you are, or work for, a "covered entity."