Sadly not true:

https://cdt.org/insights/law-enforcement-national-security-a...

>The HIPAA Privacy Rule provides a broad exception for national security purposes. Under the Rule, a covered entity may disclose any and all protected (identifiable) health information (PHI) for “lawful intelligence, counter-intelligence and national security purposes” (emphasis added). On its face, the Rule does not require a court order or any other enforceable or formal demand; disclosure may be completely voluntary and may be initiated by the covered entity even in the absence of a request from a government official