How is that in any way related to HIPAA? The patient has to contact the company and give them their information. The company then bills their insurance. No one is exposing their private health information.
Point being, HIPAA isn't taken very seriously.
I've seen companies closed over HIPAA violations, and I've seen folks go to jail. It's totally ok to ignore HIPAA until it isn't and by then it's too late.
Some people play chicken with the federal government and some don't. As always, it is up to your particular risk profile.