If i remember it correctly, HIPAA is really about healthcare PROVIDERS. So if they had somehow gotten info from someone who was not a provider, there’s no party to be in trouble. If it could be tracked down to exactly how the records escaped from the provider, the provider might be liable for fines for not keeping…