It was written with a narrow focus on regulating the healthcare system rather than explicitly and comprehensively protecting a class of data, so it just wasn't meant to impose any restriction on every other party a person might disclose medical information to.