Are HIPAA forms always required in a medical office?

I'm currently a pre-nursing student and I started my new job at a medical office (OB/GYN) as a receptionist. I've been working in health care for over 5 yrs and I noticed that this office have patients fill out a patient intake form and thats it! I asked the office manager about the HIPAA forms and she said it's not needed because this office "doesn't give out any patient info to anyone, anyway"

The office manager has been working here for almost 2 yrs, and her previous job was not medical-related so she has no prior healthcare experience and this has me really concerned. How else can I make her understand that we need to save our butts incase something happens?
Also, when we send specimen to the lab, there's a requisition form we fill out. We add patient's insurance info and patient's home address and the office manager told me to " NEVER release patient's address to the laboratory billing dept" she says i'm violating patient's privacy rights by giving out their home address. I know for a fact that in our area MD/DC/ VA it's not required to have patient authorization in order to release information for billing purpose. I told her if the insurance does not pay, who will they send the bill to??? ugh! what do i do? what do i say without being rude? I tried explaining but everytime I do she starts to raise her voice and gets really loud and it's annoying! This woman has never been an office manager, she has no idea of what she's doing, she's a friend of the doctor (hence why she's the office manager) she can't be unprofessional at times, and I think she's mad that I'm far more knowledgeable than her and I'm always bringing up what she does wrong. I correct her to help out, not be bossy. What should i do?

Are you a Covered Entity Under the HIPAA Privacy Standards?
The HIPAA Privacy Standards apply to (1) health plans, (2) health care clearinghouses and (3) health care providers who transmit health information in electronic form in connection with any transaction covered under the Electronic Transactions Standards.

Note, If a medical practice engages in any electronic transaction (even only one transaction [faxing, electronic bill payment, outside billing contractor. Karen]) covered under the Electronic Transaction Standard, then the Privacy Standards in their entirety apply to the medical practice. Also, the HIPAA Privacy Regulations apply to individually identifiable health information in any form, including oral, written and electronic communications.


Also Note, A medical practice that uses another entity, such as a billing service or hospital, to transmit standard electronic transactions on its behalf also is covered under the HIPAA Privacy Standards.

Physicians and other health care providers are required to comply with the Privacy Regulations beginning on April 14, 2003.
http://www.mssny.org/mssnyip.cfm?c=f...vered_Entities

The HIPAA Privacy Rule: THREE KEY FORMS
Complying with the HIPAA privacy rule may seem trickier than pulling a rabbit out of a hat, but these forms should help.
Notice of privacy practices
Authorization form
Patient consent form