Didn't HHS exceed their authority by covering paper and oral records?

The new report by the OMB reviews HHS's privacy regulations and concludes that HHS was within their authority in covering paper and oral records. To quote page 8 of the report: "We find nothing in HIPAA that restricts HHS' rulemaking authority related to identifiable health records to electronic data only. HHS states in the preamble to the proposed rule that it has authority under HIPAA to set privacy standards that apply to all individually identifiable health information, including information in a non-electronic form. The privacy protections afforded individuals by HIPAA would in effect be negated if health information lost its protection merely by being printed or read aloud.  more