I'm sorry, Addie, but that is not true. HIPAA (
the Health Insurance Portability and Accountability Act) provides that medical personnel may communicate medical information only to people specifically designated by the patient in writing in advance. The penalty for violating the act is up to a $10,000 fine and one year in prison.
When I worked at the medical school, all employees - including me, and I had no contact with patients or protected health information - were required to take HIPAA training. Medical facilities take it very seriously. I'm surprised they left your chart in your room. Most large facilities, and even smaller ones, are using electronic medical records now, in part to comply with HIPAA.