Recent quotes:

Privacy in the age of medical big data | Nature Medicine

For instance, once a patient requests their own health data—which HIPAA gives them the right to do, and some concerted efforts encourage patients to do35,36—if the patient then gives those data to another individual, HIPAA does not restrict use or disclosure of those data (unless the recipient is another covered entity or a business associate)24. But the more fundamental problem is that the majority of health data is not covered by HIPAA at all (Fig. 2).