The way that works (and in fact the way that classification of government secrets works in the US) is that this information is 'born secret'.

This information is has to be kept away from the public, including journalists, but there is no law preventing journalists from publishing information about someone's health. HIPAA doesn't cover journalists, it just prevents covered entities from giving journalists information.