Can a commander request medical results from providers?

Under the Military Command Exception, a covered entity may disclose the PHI of Service members for authorized activities to appropriate military command authorities. It is important to note that this exception does not require covered entities to disclose PHI to commanders, it only permits the disclosure. If disclosure is made, then only the minimum amount of information necessary should be provided. Further, the Exception does not permit a Commander’s direct access to a Service member’s electronic medical record, unless otherwise authorized by the Service member or the HIPAA Privacy Rule.

(From a PDF info paper that's in the second link).

https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/HIPAA-Compliance-within-the-MHS/Military-Command-Exception

The Health Insurance Portability and Accountability Act (HIPAA) permits protected health information (PHI) of Armed Forces personnel to be disclosed under special circumstances. Commonly referred to as the Military Command Exception, covered entities such as military treatment facilities may disclose the PHI of Armed Forces personnel to Command authorities for authorized activities.

These activities include fitness for duty determinations, fitness to perform a particular assignment, or other activities necessary for the military mission. PHI disclosed to military command authorities, while no longer subject to HIPAA, remains protected under the Privacy Act of 1974.

https://www.army.mil/article/46296/release_of_protected_health_information_to_commanders

It seems a little grey area since commanders can request PHI to determine readiness...but not sure about the direct access to medical records. You may want to see about talking to patient advocacy at the hospital. Perhaps JAG? It's a bit iffy the commander got the results before you did.

There are exceptions made for Military Commands. There are clear rules that manage it. If you feel that your HIPAA rights were not upheld speak to patient relations but I would walk through everything before you ring that bell because they are probably within the boundaries of Military Command Exception. https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/HIPAA-Compliance-within-the-MHS/Military-Command-Exception

Medical providers will sometimes call the commander directly if there is a significant readiness or safety concern. “This Soldier should not be doing physical activity until we get a better idea of what’s going on,” “this Soldier is non-deployable due to behavioral health issues,” etc. If you were put on a temporary or permanent profile, they entered it into an automated system that the commander can view.