When companies advertise on TV that they automatically (patient need not request or accept each order) ship replenishment supplies for C-PAP based on eligibility... yeah... HIPPA is a joke.
Point being, HIPAA isn't taken very seriously.
I've seen companies closed over HIPAA violations, and I've seen folks go to jail. It's totally ok to ignore HIPAA until it isn't and by then it's too late.
Some people play chicken with the federal government and some don't. As always, it is up to your particular risk profile.