Not to excuse it, because spying on your users — particularly in an identifiable way, and doubly so given the sensitivity of this specific case — is a shitty thing to do, but it's not like this is unprecedented.
I agree. My experience with tech industry, IoT in particular, deserves quoting Avasarala on this: "My life has become a single, ongoing revelation that I haven't been cynical enough."
No, because HIPAA covered entities and the information held by them to which the Privacy and Security rules applies are very explicitly defined, and how retailers categorize products is not a factor.
> And if not, should it?
Probably not, though you could probably make a good case that a more general privacy law not focussed on relations between healthcare providers, payers, and patients should exist and apply.
No. If it were, Amazon would've shut the entire category down by now.