who does hipaa not apply to