[Polybius]

The hospital, in a letter, wrote that if she wanted to find out exactly what happened, she would have to sue them.

Translation: A nurse or doctor or pharmacist screwed up REALLY, REALLY badly and they are not going to admit it without a court order.

Not quite. Read what they were demanding to satisfy the meaning of "find out exactly what happened".

"......her lawyers are demanding that Orlando Regional Healthcare System Inc., which operates the Longwood hospital, release information about other victims of the same bacteria."

That means that if Blood of Tyrants had had such an infection, she and her lawyers were demanding the information in Blood of Tyrants' medical record.

That is specifically prohibited by Federal medical privacy law under HIPAA .

HIPAA........SEC. 1177. (a) OFFENSE.--A person who knowingly and in violation of this part--........ "(2) obtains individually identifiable health information relating to an individual; or.......... "(3) discloses individually identifiable health information to another person,............. shall be punished as provided in subsection (b)........... "(b) PENALTIES.--A person described in subsection (a) shall--........... "(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;

[inquest]

I think the key phrase may be "individually identifiable". As long as the names aren't given, it should be legal.