Possibly, if not for some very important exceptions. Disclosures made for the purposes of treatment, payment and health care operations are excepted. For most organizations, this exception covers the vast majority of information sharing. For example, a hospital would not have to keep track of health information sent to outside doctors providing follow-up care to patients. It's not uncommon to find a privacy policy posted on web sites.
Many web sites collect personal user information in the form of cookies or forms.
Since wary users are concerned about improper or intrusive use of their information, sites have developed and posted privacy policies to explain how their information will be protected. Don't shred all that paper yet. Individuals maintain the right to a paper notice, even if they receive an electronic version. The rule came under further scrutiny at the Executive level when Bush moved into the White House and Tommy Thompson into the Department of Health and Human Services as its new Secretary. The Administration decided to re-open the public comment period during the extended Congressional review period.