HIPAA only governs the disclosure of electronic medical records. It has nothing to do with Social Security numbers, except to the extent that they appear in your electronic medical records.
Generally speaking, there is no law against asking someone for their Social Security number. It is a request for information, protected by the First Amendment. Reciprocally, there is generally no law requiring you to disclose your Social Security number. Your choice not to speak is similarly protected by the First Amendment.
A business can ask for your Social Security number, and you can want to keep it private. In that case, one of you can compromise to make a deal, or you can both walk away having lost nothing.
There are, however, certain types of transactions for which a Social Security number is required under 31 CFR 1020.220. This includes setting up a bank account and transactions that have to be reported to the IRS. If you want to engage in one of these transactions without providing your Social Security number, you're out of luck.