You are forgetting a couple of things here.
-
Under certain situations covered entities are permitted to disclose information to law enforcement.
https:// www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html
-
They think they're answering to good guys in the government that only want to keep Americans safe.