Is it really? If Alice tells Bob she has diabetes and Bob tells Charlie, is Bob in violation of GDPR?
How you're using it, it sounds like Bob or Charlie in your mind is a person. I might be wrong in interpreting it that way. If so could you give another example where Bob and Charlie are companies and the information of Alice is part of a transaction.
>If Alice tells her coworker Bob that she had diabetes, it's not a HIPAA violation for Bob to tell Charlie.
I was responding to the parent comment's claim that it's not a HIPAA violation but rather a GDPR violation.