In the US, HIPAA requires companies to sign a BAA to handle any protected information. That's pretty much the only thing stopping data from being shared. That is why, for example, a company website might use Freshpaint or a similar service instead of Google Analytics, as Google will absolutely not sign a BAA for the Analytics platform.

Your data is still collected by a third party analytics company, but they contractually bear all the legal responsibility for maintaining compliance. AI scribe companies are much the same