@lrvick you can file a complaint at HHS Office for Civil Rights if you choose to go the route that this is a HIPAA violation. Here are more links that may be helpful:

https://www.hhs.gov/hipaa/index.html

https://www.hhs.gov/hipaa/for-professionals/faq/health-information-technology/index.html

https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html