I don't think they actually gave him any information, but it doesn't matter. There are no circumstances where it would be possible for dad to violate HIPAA here. HIPAA binds health care providers, insurance companies, and other people who have access to health information as part of their business. It does NOT bind patients or anyone else with access to health information. For example, if you tell someone about your mom's surgery, then you have NOT violated HIPAA, no matter how much she might not have wanted the person you told to know anything. And it is NEVER a violation for someone to ASK for information. If there's a violation, it's in the releasing, not the requesting.