Yep. I mean, they do release that information all the time so either the players are specifically consenting or it's part of the CBA. But, HIPAA does apply to union employers, and everyone really, so if it doesn't apply it has to either be because of the CBA, the players sing a release for specific information, or both.
But, I think it's also clear that what the teams can release is very limited. They can say things like knee problem, neck problem, doubtful for this week, but not the specifics. The weird part about all of this is it's really only done because of gambling on the NFL. Fans want to know this kind of stuff, but gamblers and sports books are the only ones who NEED to know.