Assuming this is a standard private practice, this office has several violations of 45 CFR §164.520(a)(b)(c), assuming that he was also not provided this privacy statement within 30 days with a reason for why it was not provided on the first visit.
This makes them liable for $50,000 in fines per failure to a max of $1.5 mm (this would be a clear cut case of reckless indifference.) The DHHS OCR is always looking for some head to serve on a platter to justify themselves as well.
His amendment to the form is damning evidence and that receptionist should be fired, there is no excuse for basic HIPAA noncompliance in 2011 (8 years after the fact).
Edit: What some people don't seem to understand is that signing the privacy practices notice (the form in question here) does not mean you agree to the terms and conditions outlined. You only sign that you have received them. Additionally, whether you sign the form or not it applies to you, and whatever that form states HIPAA clearly outlines what powers the covered entity (the doctor in this case) has over your information.