GP's comment paints Alice/Bob/Charlie as people:
>If Alice tells her coworker Bob that she had diabetes, it's not a HIPAA violation for Bob to tell Charlie.
I was responding to the parent comment's claim that it's not a HIPAA violation but rather a GDPR violation.
How you're using it, it sounds like Bob or Charlie in your mind is a person. I might be wrong in interpreting it that way. If so could you give another example where Bob and Charlie are companies and the information of Alice is part of a transaction.