This came up with the Zeke Elliott thing the other day, but apparently it's only a HIPAA violation if they're getting the info directly from physicians. If, say, an agent tells someone their client has COVID, it's not a HIPAA violation, although certainly still ethically dubious. It's still a HIPAA violation if it's not released by the patient. HIPAA doesn't apply only to physicians.