This can depend on the type of organization you work for or the nature of the suspected violation. For example, healthcare activities in some educational institutions are not covered by HIPAA, while some disclosures of PHI are permitted by the Privacy Rule even when they might appear to violate HIPAA – for example, disclosures to public health agencies. Your best course of action is to ask your supervisor why HIPAA doesn´t apply to the suspected violation and use a third party source to confirm the supervisor´s response. It may be the case that your supervisor is misinformed about when HIPAA applies, and your violation concern may have to be escalated to the HIPAA Privacy Officer.