Information that your employer receives due to your employment, not because of any treatment relationship, is not covered by HIPAA. Your boss was entitled to the results because it was an employment physical, and she did not have the same obligations of confidentiality as if you were a patient.