If the office has an office manager that is the one to make an official complaint to , or maybe even the state medical board??

Not sure who is responsible for the following of Hippa /privacy rules...
You might do a search on that angle of it.