It is stunning just how much a lack of education and expertise went into this. This says nothing about HIPA, security, scaling, data source integration. It's staggering how much misinformation this PR stunt is going to cause.
Their site doesn't ask for any data except your zip code then forwards you on. Where does HIPA come into play?
HIPAA is not implicated in the new health insurance marketplace. HIPAA protects personal medical information, and under the Affordable Care Act, you cannot be asked any personal health information on any insurance portals because insurers are required to cover any pre-existing conditions.
HIPAA covers far more than privacy.
Now now now. They're only 20 but "have plenty of experience working at places like Twitter and Microsoft." Surely they \cough\ know what they're doing.