Of particular note are the exemptions in 45 CFR 164.512(k)(2) applicable to powers granted by executive order 12333 (on mass surveillance). When this exemption is used it makes discovering whether, when, how, or why your data was collected or used practically impossible.
https://www.law.cornell.edu/cfr/text/45/164.512
And then there's the HHS interpretation of the above for providers, which is... porous:
https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe...
Of particular note are the exemptions in 45 CFR 164.512(k)(2) applicable to powers granted by executive order 12333 (on mass surveillance). When this exemption is used it makes discovering whether, when, how, or why your data was collected or used practically impossible.