It doesn't matter if one is a physician, health care worker or business associate, one has a duty to protect the information if one lawfully comes into possession of PHI.
Next comes the ethical question of whether one should discuss PHI, even if it is disclosed by untoward means.