In any case HIPAA will protect you. Your provider will have a business associate contract with them, so they're subject to huge fines if they violate that.
This is a demo. In real life this'll be wrapped with a whole lot of legal contracts.
> in any case, HIPAA will protect you
It protects you insofar as it disincentives honest actors from doing sketchy things with your data. It's punishment for orgs, not protection for patients, like how laws against murder punishes the murderer rather than protecting the victim.
The best thing a patient can do to protect their privacy is to be actively avoid of medical practitioners that, for example, use tools like this which send your private medical consultation transcripts to God-knows-where.
They can be held accountable, but it's unclear how much specialized training or experience they actually have. They could have had a 6-month course, an online course, etc.
And of course you're assuming their EMR is actually secure. In a small office you can usually find the passwords you need stuck to the monitor or under the keyboard.