define business need to know

I worked as a telephone advice nurse until a few weeks ago, when I received a call from a young man that rents a room from me. I provided advice to him, as I would have for any other patient. I know him. He rents a room from me, but we aren't social friends. We aren't related. Because he and I have the same address, it was flagged as a possible hipaa breach, so it was investigated. This happens occasionally if you happen to care for someone with the same last name. I assumed that my explanation that I considered this call the same as any patient call, along with a statement from the patient confirming the call details, and the fact that he called as a patient would clear me. Instead, I was terminated from my job of 22 yrs. Every one agrees that this wasn't a hipaa violation, but violated another facility policy prohibiting chart access of "friends or others for personal use, or without a business need to know" I was very aware of this policy, and always assumed that the definition of "for personal use meant MY personal use. I am now being told that, because the patient, who was new to our system, asked for me personally, thus, it constitutes personal use. In other words, the PATIENT called for personal purposes. By that definition, every call is for personal use, since every patent calls for their own personal needs to be met. The facility is calling this "misconduct" so I don't even qualify for unemployment. Every prospective employer's demeanor changes when I disclose that I was fired for alleged violation of a privacy policy. My career is over due to one minute of trying to help a confused and upset young man get the care he needed. Hipaa hysteria has ruined my life, and i suppose I will need to figure out how to earn a living some other way. Hipaa makes it illegal to be human, imo. Amazingly, since I was fired 4 days before the end of the month, I needed to get some preventative care. I work In a system where we receive care in our own facilities. Apparently, news of my upcoming appointment was all over the clinic, including emails that staff sent to each other, and to my former supervisor, speculating about "how I might act" THAT seems like a hipaa violation to me, but nobody at the company seems to care about that. Is there an outside agency to report hipaa violations to? I have several of the emails that were sent back and forth.