Mercy Hospital (is the name intentionally ironic?) reported a woman to Child Protective Services because poppy seed bread made her fail a drug test. The test was designated "only for medical treatment." Sending the results to government authorities was an egregious HIPAA violation.
"Mercy" hospital knows about HIPAA. They're suddenly very concerned about their victim's privacy when they're asked any questions.