HIPAA governs all clinically licensed or related employee behavior at any time, regardless of setting. Unless the athletes have signed releases in good faith + not under duress saying that the provider or office can share personally identifying or confidential health information (which doesn’t just mean immediate biography—it also means anything that could possibly be construed as incriminating, embarrassing, scandalous, private, etc. that isn’t an immediate or public threat, anything in their chart) with specific, named third parties, the provider cannot just fork over charts or PHI to somebody just because they’re employed by the same institution. Exceptions being something reasonable like, we need to contact your pharmacy or PCP, or a nurse or administrator in the same department is going to handle the scheduling and charting software when I’m gone. Even admins can’t go very deep into patient charts, though, without risking “breaking the glass,” and looking up charts of co-workers, students at the institution, etc. who use the facility is always deemed a “breaking the glass” situation, at least at my university medical center and state. I can’t imagine Washington State would be too different.
Now, you could have a super-shady situation like MLT/CGA where the “sports psychologist” isn’t actually a licensed clinician like a PsyD or LMSW, and what the athletes are doing is not technically clinical therapy, but time with a “life/mental coach” or “motivational speaker” that is presented as sports psych but not actually licensed or coded as such. In these cases, confidentiality goes out the window, because this is not clinical activity that falls under the purview of any professional credentialing, licensing, or ethics board organizations, nor HIPAA. This can’t be ruled out with situations like these. It is also possible that information was authorized to be communicated to trainers or PTs at Washington, and they snitched and violated HIPAA, or the release was worded vaguely, intentionally, so that Ray could be included as training staff or something. Whether this would hold up, I’m not sure, but releases made under duress do not. Apologies for all these edits, but more possible scenarios keep popping into my head.
ETA: I don’t know NCAA guidelines terribly in depth about this, but Miss Val talked about how there are also specific provisions where coaches are not allowed to interface with clinical staff or physical therapists in certain ways, like she got in trouble one time for bemoaning that somebody was out with an injury and joked that why hasn’t medicine come up with a magic cream to fix the injury? Who knows, Val is batshit, but I’m not surprised such rules exist, and it sounds like whatever was going on, it sounds like Ray was taking advantage somehow. I would also be extremely suspicious if a large patient cohort came into my office or ER and everybody wanted to sign releases to share PHI with the same third party entity, who was neither clinical staff, their attorney, nor family/partner/next-of-kin/best friend/what have you.