HIPAA compliance has many loopholes. Providers and carriers (insurance) are bound by them, but random private companies are not generally. Most covered entities are going to insist anyone they share data with also be compliant, but it's not necessarily a requirement. Not to say it's trivial, either, but it's not exactly a huge challenge to get 100M annotated anything, really.