HIPAA is a lot less restrictive than seems to be made out. Is the NFL a covered entity? HIPAA is only applicable in the case of "covered entities" and there are some odd rules that apply to that.
It doesn't apply to employers, only to healthcare and insurance providers; people whose primary job is the practice of medicine, and only then if the transactions are done electronically (in order for the law to not be struck down under federalism laws and hold to the commerce clause I imagine). Even if you argue that the evaluators themselves are providing medical care through diagnosis, it's not something people expect to hold up in court.
Even then, the scouts and coaches I do not believe can even violate HIPAA laws in the first place once they receive the information (in that case, any media coverage of a diagnosis would be covered, too).
It could also be such that players agree to the disclosure of medical information upon accepting the invitation to the combine, which would make HIPAA irrelevant. We know players sign them with contracts to their teams. I find that exceedingly likely.
A lot of the red flags I'm referring to cropped up at the combine, though Hayden, Verrett and Dennard did not. Tiny Richardson was suspected of having knee issues, but the confirmation of osteoarthritis occurred after his playing career was over, IIRC. Jesse Williams and Cyrus Kouandjio I think fell specifically because of the combine medicals.
Star was diagnosed at the combine and they got super specific about it. It's why he didn't work out at the combine, because his medical evaluation at the combine didn't allow him to.
My point about Teddy's heart condition is that it didn't come up because it was so minor. I mean it was mentioned in passing by Zimmer or Spielman, and other teams brought him in, too (Jaguars, Browns, Texans, Patriots, Raiders and Buccaneers, and I think others) probably to just double check.
I don't think the heart thing dropped him at all. Was just a blip and didn't show up in any of his previous physicals.