Unless Santa has diversified rather far afield, I'm pretty sure his enterprise does not meet the definition of a Covered Entity[1].

[1] https://privacyruleandresearch.nih.gov/pr_06.asp

The best way to understand if something is a HIPAA violation is "Can someone who isn't the patient or doctor find any PHI?"

So unless Santa stores health information in his Naught/Nice list, he's HIPAA compliant.

Serious question: Was that really a serious question?