Well IAAL (information access law is actually what I do) and I'm telling you HIPAA isn't at issue here. Obviously Discover should be paying cashback on all legitimate purposes, though it's not obvious to me that they are somehow prohibited from asking for verification simply because that wasn't spelled out in its terms. And them asking for a receipt does not violate the law.

IF I made legit purposes, Discover was refusing to pay, and I didn't have a way to prove it, I'd definitely be pissed. But I still believe that the little information contained on a receipt could be redacted to resolve legitimate privacy concerns.