From "Pharmacy privacy Requirements here [1], I don't think "business associate agreement [with] some vaguely care-adjacent purpose" meets the standards for information-sharing. Rather the information must be being shared as part of specific treatment for a patient (discussing actual care) or payment.
[1] https://www.uspharmacist.com/article/hipaa-privacy-security-...
HIPAA is a fig leaf. Cardboard covers on clipboards to inconvenience the nurses and receptionists, but a unencumbered infobahn for anyone who touches the money to drive straight through.
For decades, every visit, test, procedure, and medication you've ever had paid for by a health insurer in the US got dumped straight into MIB, where any insurer could look at it. HIPAA functionally changed this not a whit.
I think this is what the GP was referring to. It's not just for care but for payment and operations too. A few operational examples, in the case of pharmacies, they must make sure that a patient doesn't fill the same prescription twice. Health insurance companies receive clinical data from health care providers for the purposes of HEDIS reporting.
Don't forget, the second P in HIPPA is portability.
https://www.rxhistories.com/irix/medical-data/
>How It Works
>1 Applicants sign a HIPAA-compliant authorization, enabling insurers to retrieve their medical information
>2 Insurers electronically query Milliman IntelliScript in real-time
>3 Milliman instantly gathers information from multiple data sources
>4 Irix interprets the data and generates automated decisions based on the insurer's guidelines