De-identified data and data contributed by people (read, not Covered Entities) is not covered by HIPAA. Someone could build a database of procedure cost comprised of these data sets, but price transparency isn't so easy due to the nuances of the problem (See Castlight Health).