That's surprising to me, because I usually see HIPAA taken very seriously. (I think the problems are more likely to be that personnel don't understand information technology and how fragile and untrustworthy our own "tech" field's work is today, not that they don't take HIPAA seriously.)

Related: On check-in for a doctor appointment, I was given a routine consent form to opt-in to some kind of sharing of info (for research purposes, or something like that). I instead checked the checkbox on the form that explicitly did not consent. The person at the front desk didn't seem to quite know what to do with the form when I didn't check the checkbox that was expected, but they accepted the form after a confused pause, and hopefully it was processed correctly.