Well for 35 years I been cool with the feds and canaibis and firearms so I really dont think you know WTF your even talking about,HIPAA laws are federal laws, MJ is still illegal federally, how'd ya like that, lol. A doctor that takes/reviews MJ license applications etc, are required to be HIPAA compliant, a dispensary (most of them??? idk) might not be covered entities, HIPAA regs would not apply. If they (Feds) want your information they can always use subpoenas or warrants since cannabis is still a schedule 1 narcotic and federally illegal.
To know who HIPAA laws apply to, you need to figure out if they are a covered entity.
I am not a legal expert at any level but have some understanding of HIPAA law. I'm not very clear of the relationship between MJ licensing, physicians, dispensaries, and the medical records involved.
The law on MM is so relaxed and normalized in 33 states (for the slow people that is well over half the US).