Yes. They can tell law enforcement; in many cases there is a duty to report. But that is to LEOs, not newspapers.
Makes sense. Although I don’t have the law in front of me to check for certain, and I’m not in the least inclined to look for it.
So there’s still the possibility that he violated the law either without knowing it or for some other reason. In other words, the existence of HIPAA isn’t sufficient evidence to discount this story.