The site might be deemed a Business Associate, depending on the specific facts, which we don't fully possess. That's why I recommended the owner seek counsel.
The landing page doesn't make it clear whether providers are expected to use it or not.
https://www.hhs.gov/hipaa/for-professionals/covered-entities...