The fake abortion clinic isn't a medical provider and isn't therefore subject to HIPAA. They seem to have broken several laws, but HIPAA isn't one of them (unless the data was leaked by an insider, which is a possibility).