Sounds like a HIPPA violation..
It’s HIPAA.
HIPAA is toothless. Long has been. There is no private right of action under HIPAA. You can’t sue ANYONE for violating HIPAA.
HIPPA only applies to health care providers and accosiated entities. All other entities can share whatever information about your health they desire.