On Wednesday night, ESPN’s Adam Schefter broke the news of Jason Pierre-Paul’s amputated right index  finger by tweeting out a photo of what appear to be medical charts taken from Jackson Memorial Hospital in Miami.

Schefter’s tweet caused many to wonder about whether it represented a HIPAA violation. It isn’t, at least on Schefter’s part.

First, a HIPAA explainer: The Health Insurance Portability and Accountability Act was enacted by Congress in 1996 in order to ensure the privacy of individual medical records. It prohibits, in most cases, the release of anyone’s health care records without that person’s written consent and establishes penalties for unauthorized release by health care providers.

Here’s why Schefter got the go-ahead to tweet out that photo: reporters aren’t covered by HIPAA.

“HIPAA laws apply to a very specific list of medical professionals,” Kelly McBride, a media ethics expert at the Poynter Institute and a former ESPN ombudsman, told CNN Money.

That very specific list of medical professionals includes hospitals and the people who work at them, and that’s why Jackson Memorial Hospital and the Jackson Health System could be in some trouble here.

Jackson Health System, of course, says it’s taking the matter very seriously.

That might not be enough. In 2011, UCLA Health System had to pay $865,500 as part of a settlement with federal regulators over HIPAA violations after celebrity patients alleged that hospital employees reviewed their medical records without authorization. One of the employees, an administrative specialist at Ronald Reagan UCLA Medical Center named Lawanda Jackson, pleaded guilty to a felony charge of violating federal medical privacy laws for commercial purposes after she was caught selling Farrah Fawcett’s medical records to the National Enquirer (Jackson died before she could be sentenced).

No one is saying Schefter paid for the photos he tweeted out, and frankly, he’d be an idiot to do so because that information would inevitably come out. But the simple act of giving that information to a reporter could be cause for prosecution.

And consider this: UCLA Health System had to pay out nearly $1 million in fines because its employees were merely looking at celebrities’ medical files. Imagine if more of them were giving that information to reporters.

If Pierre-Paul believes his HIPAA rights were violated, he has 180 days to file a complaint with the U.S. Department of Health & Human Services’ Office for Civil Rights.

As for Pierre-Paul, it seems like he’ll be back sooner than anyone was expecting.