The doctor, rightfully, needs to tell this clown to pound sand. Any information is privileged. Period.
“Required by law means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand...”
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
Congress probably has reasonable cause to require production under Amendment XXV.
Joe’s doctor might get to kvetch with Steve Bannon.
Under 25th§4, as currently implemented, VP and part of Cabinet, and only them, could start a process which potentially could lead to a process under which Congress must decide whether to believe a President's claims that he is still competent or VP+'s claims he in not. In that case Congress would need to know all relevant POTUS medical information and the explicit Constitutional process would clearly trump all medical and other privacy issues, including HIPAA. Process hasn't yet been triggered so that's not currently relevant, but we're probably closer to it than at any time in the history of the 25th.
Moreover, the first sentence of 25th§4, which establishes VP and part of Cabinet as triggers, includes a clause "or of such other body as Congress may by law provide." Thus Congress has the power to modify who triggers this. If, after time resolves Biden's status, it seems he should have ben removed earlier, Congress should look at this. To see how well the current system worked, and if it hadn't worked well to consider improvements. Ideally done on a bipartisan basis, although that may not be possible. If the current triggers didn't follow their responsibility, it is Congress's Constitutional responsibility to provide a more responsible alternative. And figuring out that may also require breeches of otherwise normal doctor-patient privacy.