It isn’t.
<><><><
Again, if the school sponsors the health plan, they absolutely are bound by the HIPAA provisions. It does not matter that she told the administration, they were not within their legal rights to disclose that information to anyone else, not the faculty and certainly not the students.
Not really.
Privacy Rule
The Privacy Rule took effect on April 14, 2003, with a one-year extension for certain “small plans”. The HIPAA Privacy Rule regulates the use and disclosure of certain information held by “covered entities” (generally, health care clearinghouses, employer sponsored health plans, health insurers, and medical service providers that engage in certain transactions.)[10]
Note that there is no provision for the Sponsor of the Plan.
With that, if she signed a morality clause in her contract, they had a right to fire her. If she cannot prove monetary damages from the passing of the information she volunteered, she doesn’t have a leg to stand on. Without the HIPPA law to fall back on, she has to prove slander. The truth is not slander.
It was tactless and she should have not answered the question. If I were her employer, I wouldn’t have asked that loaded question.