The HIPAA violation would be on the care provider by transmitting in cleartext over the internet.

If they're transmitting properly over TLS then no patient info would be divulged.