Unless I'm missing something, I don't see how HIPPA would have anything to do with this. It only applies to "covered entities", so had the initial disclosure happened in the US, the leaker most likely would have been implicated, but HIPPA would not apply to Uber people (unless, for some reason, Uber is a covered entity).

Defamation, sure.