The moment someone pulls data from their doctor's office, it's no longer covered by HIPAA, the landmark privacy law .