RE: Update on the Tolsia High School (WV) non-vaxxed shaming incident.

How did the people at the school get that information to begin with? If a non-medical organization has access to that information then what do those laws protect against?