If you think the clinic's lawyers haven't already reviewed this setup with a fine tooth comb then you haven't seen how medical lawyers work. This isn't a rogue PCP surreptitiously recording visits. Its a contractor that was selected and negotiated with from on high that was subsequently deployed to all clinics in her large company.

Also, I guarantee you signed a paper when you first were enrolled with your PCP giving them permission to share your medical records with third parties when needed (subject to HIPAA compliance of course).