It may not apply in that situation. HIPAA only applies to 'covered entities', such as health care providers and health insurance companies.
"If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules. See definitions of “business associate” and “covered entity” at 45 CFR 160.103."
https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html