This is not necessarily a true statement.
First, HIPAA is subject to assorted state laws that MAY permit the release of the information to certain other parties.
Second, this is a college student and presumably an adult. Thus, his parents or guardians are irrelevant to the issue and - in theory - cannot generally receive information protected by law.
Third, without knowing the context under which the information was passed - and to whom - it is premature to make any conclusionary legal statement about the conveying of the information.
ok the child is an adult. so they should have his written consent that it is ok to speak to another student or anyone about what he takes or anything about his health.. I am in the medical field and we have to know the laws with HIPAA and follow them daily.
have a good day and Merry Christmas