The law doesn't protect it. HIPAA doesn't apply in that setting.
Attorney client privilege is an interesting case.
"Privacy issues" is a meaningless phrase to me when divorced from the law. Do you mean, like, ethically concerning? This term in the contract is neither uncommon nor illegal.
The privacy issues here are bottomless, and so are the legal issues.