HIPAA doesn't prohibit the collection and sharing of health data. It provides a framework for how such activities must be performed, describes standards and practices for data security, limits whom the data can be shared with, and, yes, requires certain disclosures. But there's no HIPAA violation if your doctor, medical equipment provider/manufacturer, and insurance company share data within those parameters.

I'm sure I signed something authorizing it, in the giant stack of paperwork I filled out along the way, but who reads every word of that nonsense? It's practically designed to overwhelm the patient. I read a lot more of those forms than anyone else I know, but I still have to skim a lot and they're always presented in a high-anxiety environment. No one can or should be expected to pay that much attention to legalese in a doctor's office.