Here's a script you can send to your state legislators and governor:

I demand a state medical privacy law at least as strong as the Minnesota Health Records Act (Minnesota Statutes 144.291-.298). Here are seven types of disclosures that HIPAA permits without patient consent or knowledge, but which generally require patient consent in Minnesota:

1. Disclosures of health information for treatment purposes, unless consent is not possible due to a medical emergency.
2. Disclosures of health information to other providers for healthcare operations purposes. [Note: healthcare operations includes over 60 nonclinical activities, including business activities. According to Federal Register, Vol. 75, No. 134, July 14, 2010 (see pages 40872, 40906, 40907, 40911), your medical data can be shared with over 2.2 million entities, including 1.5 million business associates, without your consent or knowledge.]
3. Disclosures of health information to payers for payment purposes.
4. Disclosures of health information to outside researchers for medical research purposes. [That's right, non-consensual medical research is explicitly allowed by HIPAA, but greatly limited in Minnesota.]
5. Consent of a patient’s authorized family or legal representative for disclosures of health information to funeral directors.
6. Disclosures of health information for military or national security purposes unless the disclosure is specifically required by federal law.
7. Disclosures of health information for law enforcement purposes, unless the disclosure is in response to a valid court order or warrant. [That's right, under HIPAA, medical providors are permitted to share sensitive health data without a warrant.]

Source: Mayo Clinic's Notice of Privacy Practices (link: https://www.primarycareondemand.mayoclinic.org/notice-privacy-practices)

Minnesota is the only state to have a comprehensive medical privacy law stronger than HIPAA. [State] should be the second.

General public: I'm going to make wild assumptions about something I don't know anything about, and also spend 0 time verifying if my assumptions are correct.

https://www.hipaajournal.com/hipaa-explained/

The first paragraph:

The Health Insurance Portability and Accountability Act (HIPAA) is an Act passed in 1996 that primarily had the objectives of enabling workers to carry forward healthcare insurance between jobs, prohibiting discrimination against beneficiaries with pre-existing health conditions, and guaranteeing coverage renewability multi-employer health insurance plans.

Been telling people for years that you shouldn’t tell your doctor anything you want kept completely private. They always planned to get access for government databases. Plus, healthcare systems are notorious for security breaches.