Technically, that's only a HIPAA violation if you're a provider or are handling data given to you by a provider.