I generally had otherwise considered correctional facilities to be rather mum—but it's a little different here in Canada.
But this is only a HIPAA violation if it was leaked by medical personnel (or some other covered entity). At this time, we don't know who leaked it, so we don't know that HIPAA applies.
The article suggests it probably doesn't. It was apparently reviewed and found to be some third party, not EMS personnel.
In this case would a guard leaning into the cell, watching and listening to the revival or treatment attempts by EMT personnel and leaking that information approach these laws in anyway?
For instance if Epstein was living and being treated but on the verge of death and the EMT staff didn't make any attempts to prevent spectators who proceeded to leak the information—
who would be at fault in such a case? Or does that also fall outside of HIPAA in the US?
But I think you would probably have to pass a test of reasonableness. If you are getting medical treatment in a public space, there's only so much EMS can do to protect your privacy.
In practice, it's really hard to strictly comply with HIPAA and many institutions routinely violate it in small ways.
From what I gather, law enforcement, such as prison guards, have their own rules covering confidentiality. But I don't think a prison guard would be covered by HIPAA. A leak by a prison guard would have to be dealt with via other channels.
"Hey, we as medical professionals can't disclose your health info. But we have to keep these guards around for safety, who will hear everything, and they can say all they want!"
It's within the law for EMS to disclose to the prison staff "He's having a heart attack. We need to move him to a hospital to try to save his life." That would meet the minimum necessary standard to get the patient the care he needs. That disclosure is necessary to get him released from prison so he can be transported to the hospital.
However, if an EMS person was friends with one of the guards and spent a minute or two basically gossiping about the case to one of the guards as a form of socializing, that has nothing to do with getting the patient the care he needs and would be potentially a firing offense.
There shouldn't be a loophole because the guards should be covered by other rules. They just wouldn't be covered by HIPAA per se.
The fact that HIPAA doesn't apply to the guards doesn't mean the guards can do whatever they want. It just means that you would have to discipline them under a different rule or law.
(IANAL. This is not legal advice. It's just my best understanding of HIPAA having worked for an insurance company for a few years, during which time I received annual training for HIPAA.)
HIPAA would cover healthcare in prison. It wouldn't cover, say, what prison guards can talk about.
They may have other rules that indicate this is inappropriate, but HIPAA covers specific institutions, such as hospitals, medical personnel generally and health insurance. It doesn't actually cover anyone who ever learned anything about your health for some reason.