The company I work for conducts their own urine drug screens(UDS) with a computerized machine (not sure of the name). Jack runs this machine, therefore, knows each person's UDS results. After seeing that Marie tested positive for amphetamines, Jack reports the results to Helen, the director. Helen tells Jack to run Marie's urine again with Jill present, even though Jill's job position or duties are in no way related. Jill is not trained on the machine and has no knowledge of what Jack is doing. BUT Jill watches Jack run the urine again, therefore, Jill now knows that Marie's urine tested positive for amphetamines. When the second urine sample tested positive again for amphetamines, Jill knew this as well. Jill then texted Candace, another co-worker, and told her that Marie tested positive for amphetamines. Marie was eventually approached by Jack, who is not her supervisor (he is not a supervisor at all), and was asked what medication she was taking. Marie reluctantly told Jack that she was taking a prescription med, called Phentermine, for weight control. Marie was unaware that Phentermine was an amphetamine. Jack then announces (in front of Marie), to Candace and Jill, "Its ok..it was her medication....Phentermine." Marie told her supervisor about the events that took place. Marie's supervisor was upset about Helen & Jack's behavior. He encouraged Helen to discipline Jack for his actions. Helen did not feel that any disciplinary action was necessary. Marie filed a grievance (utilizing the chain of command).
Did Jack AND Helen violate Marie's HIPPA rights? What happens if the employer disciplines Jack but not Helen? What is the employer obligated to do? What action should Marie take next?

I doubt if there is a HIPAA issue here. Since no one provided medical care to Marie this doesn't fall under HIPAA. However, the company is on shaky ground here.

Testing like this should be done anonymously. All samples should be coded so that lower level employees will not know whose sample they are testing. I don't know Jack's position or level, but I doubt if he should know who's sample is who's. Probably, only someone in HR should be able to match the codes to a person. This would have avoided the whole problem. Seems to me everyone involved exercised poor judgment in discussing anything with other people. Therefore everyone should be warned by HR about discussing private issues in public. And the procedure needs to be changed to make testing more anonymous.