I work in Federal government, and I am here to tell you that HIPAA (and PII... Personally Indentifying Information) are very severely restricted and regulated. Encryption is always used at the database level, so that only authorized individuals in that government can view it, and you must have a very good and justified reason. Generally, requests for access are always reviewed with great skepticism.
Now, that is not to say that a corrupt leader or highlevel person cannot cause great damage to the population by ordering access (without the similar skeptical review) and abusing that access....
So.....we all need to report our medical information to the FEDERAL government.... BUT it’s “encrypted,” only “authorized” people will look at it, and then under only VERY STRICT conditions.... so, remind me, WHY does the information need to be reported to begin with? Sounds like not much use is being made of it....except POLITICAL use. And, we have set up third-party payment programs that just invite fraud.