similarly, is there any question that correspondence with a public agency can potentially be entered into a public record?
As many HIPPA-related documents as I've had to sign as a consultant working in/around medical and as a patient, I'd have assumed HIPPA was in force here as well since we're talking (a) medical info that is (b) personally identifiable.