Data-protection, contractual, intellectual-property and sector requirements can apply regardless of the adaptation method. Model size, a private endpoint or a synthetic-data label is not a universal exemption.
HHS’s cloud guidance explains that a cloud provider maintaining ePHI for a covered entity or business associate can itself be a business associate even without the decryption key. A BAA, permitted-use analysis and appropriate safeguards therefore need attention before a healthcare dataset enters a supplier’s pipeline. This does not mean all health-related data or all software businesses are automatically subject to HIPAA.
For other workflows, ask counsel about the applicable state privacy, employment, consumer and sector rules. This pass does not establish the buyer’s status under those regimes. Keep raw records out of an initial research enquiry; a schema and data inventory are normally enough to begin scoping.