They aren't just random. They give away specific information about your card and where it comes from. The first digit of your credit card number is the industry identifier. This tells you the industry of the credit card issuer. For example, airline industry cards begin with a 1 or a 2. Travel or entertainment cards, such as American Express and Diners Club cards, begin with a 3.
One of the most significant amendments to HIPAA by the HITECH Act is the expansion of the categories of entities subject to the 1996 law's privacy and security rules. Plans and health care clearinghouses are also affected by HITECH, along with their business associates and certain vendors of HIT.
Furthermore, under certain conditions HIPAA's civil and criminal penalties now extend to business associates. Like HIPAA, the HITECH Act does not allow an individual to bring a cause of action against a provider. However, it does allow a state attorney general to bring an action on behalf of his or her residents. Finally, HHS is now required to conduct periodic audits of covered entities and business associates.