I have reason to believe that my personal and medical information has been obtained by my HR dept. From my DR. And has even been shared around the office to supervisors and co-employees. What can I do about this ?

What type of information ?
Have you asked your doctor if anyone has requested it ? The doctor would have proof of someone asking for it