Medical marijuana dispensaries are not covered entities under HIPAA [0]. The way the law works is weird, but they are not required to comply. All the more reason the federal government needs to catch up with the times on cannabis.

[0] https://www.hhs.gov/hipaa/for-professionals/covered-entities...