HIPAA enables and restricts data collection, storage, and sharing but in general you consented to it.

A current problem with HIPAA is that the consent forms do not clearly enough describe what is being agreed to such that someone can’t make an informed decision and there really isn’t an option to say “no” to things and still receive care without going somewhere else.

HIPAA also does not require consent to sharing “deidentified” data which has been shown many times to be relatively easy to unmask to discover who the records belong to.

Basically it needs updates from technical and privacy focused people but that’s a hard sell when people don’t really know how things work.

Consent in a medical context honestly means nothing to me anymore. Do you know how many times I've been asked to sign an electronic pad without seeing what I'm signing, asked for the form beforehand, and be told they can't give it to me until I sign it? It's absurd. They just collect an image of your signature and apply it to whatever they want. They will eventually cave if you make a big enough fuss, but unless you're Richard Stallman, no one is going to keep doing that every time.

edit: My hack in this case is now to legibly write "Can't see form" as my signature. No one has called me on it yet but I'm dying for the next disputed bill.

HIPAA doesn't prohibit the collection and sharing of health data. It provides a framework for how such activities must be performed, describes standards and practices for data security, limits whom the data can be shared with, and, yes, requires certain disclosures. But there's no HIPAA violation if your doctor, medical equipment provider/manufacturer, and insurance company share data within those parameters.

I'm sure I signed something authorizing it, in the giant stack of paperwork I filled out along the way, but who reads every word of that nonsense? It's practically designed to overwhelm the patient. I read a lot more of those forms than anyone else I know, but I still have to skim a lot and they're always presented in a high-anxiety environment. No one can or should be expected to pay that much attention to legalese in a doctor's office.