Also, from what you tell us the employee was talking with the patient. There is no proof or statement that anyone else heard what was said and it certainly was not a disclosure or treatment or condition to a 3rd party. Eavesdropping is not punishable in HIPAA regs