I believe my wife''s privacy has been violated by the administrator of the health care facility she works at.

Her boss shared information about her medical condition from her doctor''s note to two other employees, who are not supervisors/managers. Is this a violation of HIPPA? Privacy? This was not in a "concerned about her" type of conversation, it was more the three of them complaining about her condition, and her boss shared word for word what her doctor had written in her excused absence from work. Thanks for any help you can give, we are trying to decide if we need to consult an attorney, as this is not the first time something like this has happened.