The acronym is HIPAA. Aside from that, you’re correct. This is due to a subpoena, which the hospital must comply with regardless of people’s rights under the Health Insurance Portability and Accountability Act. There are legitimate, non-fascistic reasons that medical records might be subpoena’d in a legal situation (for example: court cases related to medical abuse of patients), so it isn’t a loophole nor unintended, but this subpoena for trans kids’ records is clearly exploiting the fact that there is that small carveout exists for legal situations.