My husband sent his physical forms to the representative of our insurance company for his employer. He works for the family business, which employs about 500 employees in four different stores. The idea is that at the end of the year everyone who submits a completed physical, along with various signed forms, gets their deductibles back.
The representative sent a copy of his physical to a manager at a different store from the one where he works. It was intentional, as it was faxed over to the manager with a cover sheet and an account of included material. There is no reason for him to have the physical at all, and because it was faxed, there is no way of knowing who saw it. There is very private information in the physical about medication that my husband would rather not have anyone know about.
Were his HIPAA rights violated? If so, what steps should now be taken? If not, please explain why they were not violated. Thank you...

Sounds like a violation - the insurance rep is required by HIPAA to protect private health info, and if there is no valid reason for him to have faxed it to a manager at a different store then it's a violation. How did your husband come to know that this occurred?

The manager at the other store is his uncle, who called my husband and asked why he needed the medication.