This is a frustrating conversation.

It appears that anonymized data medical data are being sold en masse by providers (*) because money. But it's also obvious to us tech folk how trivial it is to combine anonymized patient encounters with location and credit card purchase data etc to de-anonymize it and resell as enriched.

So the only people who are effectively bound by HIPAA are the well-intentioned ones who have to protect themselves and and comply; the rest are laughing at them on the way to the bank.

* https://www.theverge.com/2021/6/23/22547397/medical-records-...

* https://www.scientificamerican.com/article/how-data-brokers-...

* https://www.medicaleconomics.com/view/who-profits-our-medica...