You should report her to the office HIPAA manager, and if it turns out to be her, then you can report the whole clinic. This was a direct violation. No one should be asking you questions like that in the waiting area without your express permission.