HIPAA is the federal health-privacy law — but standalone dispensaries generally are not HIPAA "covered entities," so it usually does not apply. No agency issues a "HIPAA certification."
Why the marketing claim matters: Patient Privacy at the Dispensary.