Thank you for your question. Your previous expert has opted out, but has provided you the correct law.
I have a different opinion here. The previous expert was correct in that TYPICALLY an employer is not a covered entity. HOWEVER, when the employer is a healthcare provider, they are held to a higher duty than a regular employee
and they are bound under HIPAA to restrict access to the employee's personal health information pursuant to the HIPAA regulations. The privacy rules exempt employee records, but NOT personal health information of a hospital employee from the hospital employer accessing that information for non-HIPAA related reasons, such as employment reasons.
I believe that you should indeed file a complaint with the US Department of Health and Hospitals as they are the sole entity with authority to investigate and punish under HIPAA and there is no personal right of action under HIPAA. You can also have grounds to sue the employer and the employee for invasion of privacy for violating the confidentiality
of your personal health information under your state's laws.
I truly aim to please you as a customer, but please keep in mind that I do not know what you already know or don't know, or with what you need help, unless you tell me. Please consider that I am answering the question or question that is posed in your posting based upon my reading of your post and sometimes misunderstandings can occur. If I did not answer the question you thought you were asking, please respond with the specific question you wanted answered.
Kindly remember the ONLY WAY experts receive any credit at all for spending time with customers is if you click on OK, GOOD or EXCELLENT SERVICE even though you have made a deposit or are a subscription customer. YOU MUST COMPLETE THE RATING FOR THE EXPERT TO RECEIVE ANY CREDIT, if not the site keeps your money on deposit.
Also remember, sometimes the law does not support what we want it to support, but that is not the fault of the person answering the question, so please be courteous.