My son, 17 years old, is in an outpatient drug rehabilitation center. They do random
testing. Sessions are Monday through Thursday. He was tested on a Monday. That Thursday,
one of the counselors told his girlfriend, also a patient there, that he tested positive for
cocaine. He wasn't told by anyone at the center of his positive results until the following
Monday. I was never informed, other then by my son through his girlfriend. When my
son was told the following Monday, it changed from positive for cocaine, to positive for
pot. The pot was known from the previous test, 2 weeks prior. My question is did the center violate HIPAA by 1. telling girlfriend positive results ? And 2. giving the WRONG
results? Is there any legal recourse? Thank you!!

Yes, unless your son has expressly given permission to discuss his care with the girlfriend then this is a HIPAA violation.

You should report this breach to the director of the rehab center. The counselor should be disciplined.

But there seems to be a misconception about HIPAA. Some people seem to think that they can sue for HIPAA violations. The punishment for HIPAA violations is fines and sanctions againt the medical provider, not compensatory damages for the patient.