Here is the link to the relevant text about the privacy rule: Research . Short answer is that yes, this does sound like its a HIPAA violation.
You need a lawyer. You need a lawyer before you speak to anyone else about this, including to your school. Finally you need to understand that anything you write, including in personal Emails and on SDN, is discoverable. I am deliberately not quoting your post so that you can delete it if you choose to.
I couldn’t even look in the EMR to see if there would be enough cases until I had IRB approval or an exemption. I’m not sure there’s any way to fight it, and I definitely wouldn’t talk about it on here.