This.

HIPAA applies to only those organizations that deliver medical care or handle "PHI" (Protected Health Information) as a "covered entity" that delivers services to a healthcare delivery organization (eg, an IT company that handles Electronic Health Records for a hospital is required to observe HIPAA).

Also, HIPAA applies to those of us who have some sort of medical license, from CNA up to MD.

HIPAA does not apply to:

- you
- your employer,
- your boss
- a company that is asking for your health information before they hire you
- your insurance company (before Obamacare, insurance companies asked about pre-existing conditions all the time).

You and they are not "covered entities" nor do they have any sort of medical license. What you disclose to them is your business, but once they have that information, you cannot be assured of any privacy.