Fair question. HIPAA is pretty specific to health information handled by covered healthcare entities, so biometric collection through surveillance generally falls outside of it. But as AI gets better at analyzing biometric data and potentially inferring things well beyond identity, there’s a legitimate conversation to have about where those privacy protections should begin and end. If AI can turn your biometrics into sensitive health information, should it really matter whether that information came from a medical record or a camera?