Why is this not a HIPAA violation?

HIPAA is a US law that's focused on protecting the privacy of a person's medical history. In SQL terms you can't JOIN a person's identity with their medical history (unless explicitly authorized). However aggregated data is allowed, as long as it can't be easily reverse-engineered.