I'm not saying they were automatically relaying name/job/tests-requested of everyone coming in. I was just bringing that up as the level of "need to know" that the hierarchy would need to have in order to automatically have access to the key details in the story.

Second, I agree that the conversation with the manager is fair game (or at least, not a HIPAA violation) to relay to the head of communications.

Nevertheless, look what happened: the HoC (Buchanan) was pre-emptively given at least the information that Buhr went to the clinic (not simply that she spoke to a manager). That is itself borderline.

But Buchanan was probably also informed that she asked about the specific test in question. That sounds very much like a HIPAA violation, just as it would be if you released to the Quest Labs head of PR that so-and-so asked for an HIV test.