I think your understanding of HIPAA is reversed. It's not about privacy. It's about setting rules by which health information can be shared between organizations of different types.