This is correct. The history of legal protections for patient records, in the US at least, stems from privacy violations of HIV and AIDS patients, particularly gay men for whom the exposure of HIV status doubled as outing.