I am not very savvy with the ins and outs of HIPAA, but I just got slapped down for a grey area on ADA and was advised about a doctors note that contained Employee health data and my possession of it. Due to the employee feeling they had to share with me, to meet employer 3+ days out on sick leave mandate. I was shocked that just by having that in my possession there was potential privacy issues. Rightly so the ADA compliance officer at work, not only advised me to delete it but to also notify the employee that I no longer had it in my possession.
Rules are different I guess if you are a Billionaire CEO, who just outright discloses to the general public the medical conditions of an employee. Seems like two sets of rules to me.