Classic tale of VC-backed “startups” going the Uber/Airbnb route and deciding the established rules aren’t worth following.
> For example, tracking technologies could collect an individual’s email address and/or IP address when the individual visits a regulated entity’s webpage to search for available appointments with a health care provider. In this example, the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply.
As long as penalties are lower than the profits (and no execs go to jail), the rules aren't actually worth following.
Maybe the real innovation of the tech sector in the last decade is figuring out that established laws aren't actually enforced anywhere well enough so you may as well break them.