This doesn't come close to a HIPAA violation. This is simply office gossip. It may not be appropriate and HR might want to be informed. But since no one is treating him or has access to his medical...