What constitutes a medical record? Those are folders (or the electronic equivalent) showing test results, diagnosis history, indicators tracking over time - basically, a collection of facts. ESPN reported something that they acquired secondhand, which is far short of the intent of HIPAA in my view. Put another way, "The USA is believed to be expanding its presence in Afghanistan!" is not a report on troop movements that undermines national security interests. There are also holes in HIPAA for when disclosure is
mandated by state law (e.g. public records).
Then there's the fact that FIPA has no private cause of action.
Here's a briefer on the law. It has a broad definition of personal privacy and one of the first obligatory disclosure (to the affected individuals and the state) if and when there is a security breach. It's designed for hacking situations, not press publication.
And that's before you get into, ya know, 1st-amendment stuff. IANAL, but the trend with things like Bartnicki v Vopper (criminal, not civil), Florida Star v BJF (naming rape victim, not medical privacy), Cox Broadcasting, etc seems to be that privacy actions against media organizations won't survive unless they meet the NYT v Sullivan standard.
Here's a handbook from the FL bar association discussing media publication and privacy rights. It cites a lot of cases. IANAL, again, but suffice to say, ESPN has a lot of criteria on which to hang their hats, e.g. newsworthiness.
Bottom line: I'd be willing to bet that JPP is never getting awarded a red cent by the florida courts. ESPN might settle, of course, for other reasons unrelated to the merits.