My healthcare providers explicitly state they are selling my email and name to data brokers. How does this not violate HIPAA?

I'm genuinely confounded by this. The app for the company my therapist uses states before I even use it that I need to agree to a privacy policy, of which once read says they will share data from this app with third party services for marketing and analytics. My primary healthcare provider has a similar policy where they state they sold my phone number, and even gave me a list of the companies they sold it to. Does this not …

app brokers data data brokers email healthcare healthcare providers hipaa name policy privacy privacy policy selling share state states the company