Customers are not bound by HIPAA, no. Random people aren’t, only like medical professionals and people that as part of their job duties handle that information.

I could recite someone’s medical history from a soapbox in a public place, but since I’m not bound by HIPAA, it is not a HIPAA infraction.