I have HIPAA training at work every 6 months and I can say with certainty that it does apply to businesses and not just health care providers. We cannot even store nor transfer health related data without proper security measures in place to protect PHI.