What to do when an employer violates the HIPAA law?

Your husband could sue his employer for invasion of privacy.  One aspect of invasion of privacy is the public disclosure of private facts which occurred here when his confidential medical records were disclosed to other employees.

In addition to a cause of action (claim) for invasion of privacy, the lawsuit should also include a separate cause of action for negligent infliction of emotional distress.  Your husband's employer owed your husband a duty of care to maintain the confidentiality of his medical records.  Disclosing the information breached the duty of care and was the actual and proximate cause of your husband's emotional distress.  Actual cause means but for the disclosure of the medical records, would your husband have suffered emotional distress?  If the answer is no, then actual cause has been established.  Proximate cause means despite the disclosure of the medical records was there any unforeseeable intervening event which would relieve the employer of liability for negligence?  The answer appears to be no, which means that proximate cause has been established.  Therefore, the employer is liable for negligence (negligent infliction of emotional distress in this case). 

Intentional infliction of emotional distress as opposed to negligent infliction of emotional distress would be more difficult to prove in this case because the employer would have had to have committed an  extreme and outrageous act (disclosing the medical records) intended to cause and which did cause emotional distress.  Establishing the requisite intent on the part of the employer would be difficult.  That is why it would be advisable to pursue negligent infliction of emotional distress instead of intentional infliction of emotional distress in the lawsuit.