HIPAA (privacy portion) covers more than just your data, so I could see the same thing here. What if "your" medical data was private, but all the metadata about where you are treated could be recorded.
Can you imagine if they decided HIPAA didn't consider "metadata" private? Sure, the doctor's notes are private, but the list of every procedure you've had and every drug you've taken doesn't count.
