They are allowed to ask. Do you think there’s a law that forbids someone, anyone, from asking you a question about your health? They aren’t stealing your information, they are asking you. HIPAA was meant for medical care workers and medical facilities and medical insurance and anyone working within or around those areas. When you walk into a grocery store, they are allowed to ask you if you’re vaccinated. Your neighbor can talk about your hemorrhoids. Your sister is allowed to talk about your heart condition with other people. Your mother-in-law is allowed to talk about your medical conditions behind your back. Anyone is able to tell anyone else about whatever they want to with regards to your health information. You could sue them if you could prove damages. It has been driving me nuts for months that people keep a scribing magical powers to HIPPA that don’t exist.