I'm not an expert on the matter, but to my knowledge Samsung aren't health practitioners and aren't beholden to HIPAA laws for data that was (presumably) voluntarily provided to them. Is this scummy? Abso-fucking-lutely. But as far as I'm aware they have a lot of freedom when it comes with data collected with permission from users. Obviously this is something that should be addressed/regulated.

It certainly is. HIPAA binds healthcare providers and those entities who get data from them. Samsung is not bound by either of these, unless it is sourcing the health information from, like, your doctor, and not from your watch.