You're right on the second point but a bit mistaken on the first. HIPAA is broader than just doctors and their staff. It applies to any covered entity (health plan, health care clearing house, or a health care provider transmitting health information in electronic form) or their business associates (specifically in the context of contractors who also handle the transmission of protected health information). So your insurance provider is a covered entity, and they probably have a business associate agreement (BAA) with whatever software companies they contract with to store and transmit your information.

But yeah, if you found a medical chart on the street, you aren't bound by HIPAA.