>Are they bound by it when they receive data or only when they pass it somewhere else?

Neither based on my knowledge. They can do whatever they want with the data and give to whomever they want with no restrictions from HIPAA.

edit: Note that their privacy policy may provide protections and the government may get angry with certain sharing but only if it's politically useful (ie: tinder, hiv status and china).