HIPAA only applies to healthcare providers with access to your personal health information. It doesn't apply to your boss, HR, coworker, friend, etc...
If you disclose personal health information to a 3rd party not bound by HIPAA they can legally share if with whoever they want.
This situation...