My answer to the original poster dealt solely with the HIPAA privacy rule issue, and was absolutely correct.  As a corporate lawyer who's only courtroom experience is as a defendant in traffic cases, I deferred to other posters with respect to non-HIPAA issues, and said only that I'd look into whether the cops' actions raised 4th amendment issues (i.e., whether a warrant is necessary.)  

The poster asked if HIPAA restricts what the police can disclose.  The link you provide concerns what covered entities can disclose to law enforcement agencies (or anyone else for law enforcement purposes).  The link does not address the obligations of a law enforcement agency under HIPAA -- because there are none.  In fact, HIPAA does not apply to AMPs either.  In lieu of taking a “HIPAA Class,” as you recommend for me, here’s HIPAA 101 for you:

HIPAA applies to three types of entities (called "covered entities"): (1) health plans (who pay for health care), (2) health care clearinghouses (who deal with electronic communications between plans and providers), and (3) health care providers who electronically conduct certain types of transactions (known as "standard transactions," such as submitting electronic claims to Medicare).  Police officers and police departments obviously are not health plans, health care clearinghouses, or health care providers.  Thus, they are not covered entities -- and even if they obtain protected health information and disclose it in a manner that would be a HIPAA violation for a covered entity, by definition they cannot violate HIPAA.

At first glance it may appear that because AMPs supposedly provide massage therapy (arguably a health-related service), an AMP may be a covered entity as a health care provider.  However, even if they could be called health care providers, I would bet anything that you'll never be able to find an AMP (the ones we're talking about, anyway) that conducts standard transactions electronically.  Accordingly, the AMPs in our universe are not covered entities either, and by definition cannot violate HIPAA.

So, I reiterate my answer from my prior post that HIPAA does not place any restrictions on police activity.  I'll go even further this time, and say that HIPAA does not apply to typical AMPs either.  You quote the preamble to the privacy rule, stating that it is enough to “prove me wrong” (I'm adding some emphasis):  "The Privacy Rule is balanced to protect an individual’s privacy while allowing important law enforcement functions to continue. The Rule permits COVERED ENTITIES to disclose protected health information (PHI) to law enforcement officials, without the individual’s written authorization, under specific circumstances summarized below."  The preamble is just as explicit elsewhere that the HIPAA privacy rule does not apply to non-covered entities.

Class dismissed.

By the way, it's too bad I’m doing this for free, as my bill would be enough to cover at least a two hours' worth of "therapy" from most of the “providers” we discuss on this board...