Just to be clear about this an entity doesn't have to be a provider or insurer to be bound by HIPAA or HIPAA-like regulations. Generally companies that contract with or for "covered entities" are going to be required to sign contracts that bind them to the same rules as the covered entity.