Possibly but maybe not. NJSIAA might be considered a business associate and fall under HIPAA standards as they can provide "management, accreditation and administrative" duties on behalf of a covered entity as it involves
the use or disclosure of individually identifiable health information.