GoodRx is not covered under HIPAA. It’s the reason why it and companies like Postmeds exist, to skirt limitations on data collection and selling imposed by HIPAA. The fact that the data leaked is more of an issue for profitability of those companies than a privacy breach for Americans. The people who are using these services in a desperate attempt to access affordable healthcare have no legal expectation of privacy already.