A lot of facilities have higher standards than required even by HIPAA and it's particularly common for psychiatric facilities to refuse to disclose anything at all they are not specifically obligated to disclose, because the mere fact of something being a psychiatric facility itself communicates fairly specific medical information.
I also wouldn't be surprised if Heilberg didn't try to get even a non-HIPAA covered entity to keep Chris under wraps.
We've kind of gone over this over and over again, but, from the SSA website: