Generally, a covered entity may disclose protected health information to facilitate treatment, payment, or health care operations without a patient's express written authorization. However, any other disclosures of such information require the covered entity to obtain written authorization from the individual for said disclosure, and disclose only that which is required to achieve its purpose. Based on the brief rendition of facts you present you may want to explore filing a complaint with the Department of Health & Human Services Office for Civil Rights (OCR). Good luck and best regards, Rob Fortgang - Employment Law Attorneys.
HIPPA is a toothless tiger. You may have additional rights under your state laws. Contact a local lawyer to find out if you do. You should file a complaint with the facility and your state’s department of health and human services.
This response is not intended to act as legal advice. I am not licensed to practice law in any state other than the State of Illinois. No attorney-client relationship is formed until you sign an attorney-client agreement with my office.