An employer is generally not covered by HIPPA. HIPPA only applies to medical providers and providers of health care plans. I am not saying there isn't some violation of privacy laws - I don't know, but I doubt its HIPPA.
I think you're right. HIPAA only applies to employers to the extent that the employer maintains medical records or provides medical care (i.e. on-site clinic, nurse, drug-testing, etc.).