I think there are far better ways to determine a child's condition and needs than asking about the mother's medical details. I'd also need to see their HIPAA compliance statement. Just based on your description of where this convo took place, they're not meeting HIPAA standards.