HIPAA restricts what non-government people can say.
It’s entirely possible the penalties applied by HIPAA could fall within the boundaries of what is and what isn’t Constitutional, but it’s also possible it is unconstitutional, and unconstitutional laws get struck down all the time when they’re thoroughly challenged, but in our legal system, they have to be challenged first, meaning someone has to make the case.
But that's obviously still a slippery slope. You get the same sort of scenario with classified documents which are at the same time evidence of government misconduct. Everyone with access to the documents agreed not to disclose them, which means there is no one who can reveal the misconduct to the public without violating that agreement.
Even so, Congress still doesn’t have the power to prevent government employees from speaking out politically, or choosing their own church or choosing not to participate in church, or from operating a printing press that criticizes Congress, or from publishing a blog criticizing the Senators from their home State. The restrictions upon government employees are entirely within the scope of their service to the government, and no further.
Or to put it another way, since Congress shall pass no law restricting the establishment of a religion, they can’t mandate civil servants in the Department of Agriculture attend a Catholic Church while those in the Department of Justice must be of a Protestant persuasion.