Only for "covered entities" under HIPAA (at least in the US)