Just got an answer on this from my own counsel, so I'll put it here in case anyone searches for this question in the future: We found the following article which states that there is a carve out in HIPAA for M&A type activities:

"'A covered entity may use or disclose protected health information for its own......health care operations." 45 C.F.Rredactedc)(1). The term "health care operations" includes "the sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity.....' Id. atredacted."

redacted

The definition of "health care operations" is condensed in the article, but the full section that is relevant here reads:

(6) Business management and general administrative activities of the entity, including, but not limited to: (iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity.