HIPAA privacy requirements apply to "covered entities" and their "business associates". A "covered entity" is a health care provider, a health plan, or a health care clearinghouse [1].

Your ISP would not be a covered entity.

If we assume that webmd.com would count as a "health care provider" (probably a questionable assumption) that would not be enough to get your ISP covered as a "business associate". Googling turns up rulings that ISPs are not HIPAA "business associates" when a patient uses them to reach a provider.

[1] https://www.hhs.gov/hipaa/for-professionals/covered-entities...