Unless the question was answered in the first sentence ('Yes!' being one of the few single word sentences possible in English). In this perspective, the second sentence gives extra information instead of 'intentionally misleading'.
If they have additional information they'd like to share, I'd very much like to hear it.
HIPAA does not apply at all as you are not a covered entity under HIPAA, stop lying.
>We do NOT have to be a "covered entity" to apply HIPAA compliant protocols to our data handling
Yeah, but that's just your current choice. You (more or less) claimed you were obligated to abide by HIPAA, but that's a lie, you are not.
I know you though nobody would call you out on this, but I am, because I understand the law. Please be upfront when asked, and stop lying.