Last time I checked, ToS had nothing about HIPAA. I even contacted them, wouldn't answer if they where HIPAA compliant or not. Wanted to know, just in case a doctor ever talks about communicating through them.

Any one that does communicate through them with their doctor, most likely doesn't know what HIPAA is or care.

To FB, it is the old "don't ask or tell" scenario.