Sure, and the point is that HIPAA is only applicable to the health organization. If you were to sue somebody under HIPAA, it would be the records organization,

Sure, and the point is that HIPAA is only applicable to the health organization. If you were to sue somebody under HIPAA, it would be the records organization, for exposing information it shouldn't have, or not logging the access to information properly. However, in this case, HIPAA wouldn't apply to a purely Indian health organization, or the records of a foreign national in a foreign organization. Note that in your situation (sex tourism) all prosecution/wrong doing is based on being a US citizen doing stuff and then returning to US soil. It does not apply to any sort of foreign national - you cannot be prosecuted for sex tourism under the US statute while on US soil if you are not a US national and the crime did not occur on US soil.