I guess the legality would hinge on what a "health department" is.

If they just asses employees fitness for duty, OJI claims, etc then they might not be a "health care provider". Even doing an FAA 1C exam could likely fall under "assessment", not "care".

Also would depend on the conditions under which you disclosed the info to DL, if there wasn't an actual or implied authorization to share that info it could be a violation... maybe that's what the lawyer was getting after. Again, varies by state.

HIPAA is like the 1st amemndent... you have to understand what exactly it means, and it's not intuitive. I belabor this for the benefit of others who might read this.