Covered entities are required to enter into BAA (Business Associate Agreement) contracts when they let other entities handle protected data. Those agreements basically say HIPAA rules and more have to be followed. You do this, for example, with AWS for your infrastructure, any other service that might be exposed to patient data, etc. With a broad perspective, these secondary entities are covered by HIPAA and it's rules, it's just technicalities with how this happens that makes a distinction. In other words you can't circumvent HIPAA by having a third party process your data.

You can however, circumvent the spirit of HIPAA and what most people would expect for data privacy by "deidentifying" your data and monetizing it in one of many ways which are wholly inadequate and usually reversable without much effort.