Signal is not a "covered entity" under HIPAA[1], so they don't need to comply with HIPAA data privacy laws. HIPAA is not a generic medical privacy law, it basically only applies if insurance claims are involved. (The "I" in "HIPAA" stands for "insurance")

[1] https://www.cms.gov/Regulations-and-Guidance/Administrative-...