If it's a legacy they almost certainly know what they're doing legally (as opposed to a 135 Mom n Pop).

There have been a variety of legal cases over the last 30 years and the dust has mostly settled on this stuff.

I'd guess the company is based in a biz friendly state such as TX or GA...

Also HIPAA has absolutely nothing to with disclosure of medical info by the patient himself.... you are always free to do that.