Should comply, doesn't _need_ to.

They are neither a healthcare provider, clearinghouse, or other covered entity.