It’s not HIPAA
HIPAA Laws have nothing to do with it. Bad PR has everything to do with it. The company has an affirmative duty to inform crewmembers of possible exposure. They cannot identify the suspect person, but they don’t have to. A date would suffice. With that ambiguity, it could be TSA, Gate Agent, Tech Ops, someone in the crew room, a passenger, etc ... Anonymity and the prospective patient’s rights are preserved. Every airline wants to cover up the number of infected, positive, and deceased, because every airline is absolutely doing the minimum or less to protect their employees.