While I don’t think it was done maliciously against them specifically, this is of course a fail in ensuring the privacy of the patients that specifically requested for their privacy to be respected. Is it known if between the other 98 cases there weren’t any other requests for privacy?

But in all honesty, why is privacy a request and not a right given to all?

this is likely a HIPAA violation. The thing conservatives crowed about back during vaccine requirements for jobs (and were entirely wrong about being related to HIPAA). The hospital would explicitly require patients to approve providing the records to the government. The government is a covered entity in HIPAA.

HIPAA explicitly allows the release of records for law enforcement investigations. However, the plaintiffs will argue this was a malicious case and done without warrants.