That's not true. HIPAA covers anyone handling protected health information in a professional manner. If some office clerk at the VA is mailing out copies of HIPAA-protected information, they're bound by HIPAA. If a consulting IT firm has access to a hospital's servers as they're changing something about the EHR, they're bound by HIPAA. Protected information cannot make its way from a "covered entity" to a non-covered entity like a totally unrelated bakery who would not have an obligation to protect your information without either: 1) violating the law, 2) you personally disclosing the information to the non-protected party, or 3) you or someone authorized on your behalf signing a disclosure waiver permitting the covered entity to disclose