Undisclosed sources close to the situation is not where you want to be with private medical information....
Very true. And since the family had already expressed an intent to share more information at a later date, they should have been allowed to do so, on their schedule and with whatever nuanced wording they wanted to use.
Bad optics for Zach here, very questionable judgement. There's no compelling public benefit argument here that I can see.
However, HIPAA regs only regulate "covered entities", which are basically the health care providers, the health plan (insurance company) which pays any claims, and various intermediaries who move or process the billing data.
Family and friends are not regulated by HIPAA. Nor, surprisingly, is the coverage sponsor, i.e., UAA. (Although UAA employees would presumably be subject to internal UF employee conduct rules that would prohibit disclosure of personal information.)