It sounds like any possible HIPAA violations would be very complicated and hard to prove. HIPAA is mostly about your records, not whether people talk about you or not. Proving unauthorized people had seen your records and/or what they have been saying came from your records or was "made up"/conjecture, might be difficult. It sounds like the many people in the agency have certainly been unethical but not necessarily broken Federal or state laws. I'm with farmergirl/Chris, I'd just move on now that you are getting things in better shape for yourself.