They usually require records for compliance with state regulations (but the state does not require them to follow HIPAA).