HIpaa is often quoted and used as a catch all to allow staff do to what they want to do. But you were better off in leaving then staying and attempting to argue with security since that is a battle you will never win on the spot.
It's frustrating for me since I work in health care and often run into someone being lazy and just not wanting to do something that quotes Hipaa, it's often funny when I explain what it is and is not, and how that doesn't apply to the task at hand. Often the story just changes to "That's our policy".
It's just sad.
What's funny is when I explain to a higher up that there is no reason for me to continue to refer patients to that imaging modality if I can't have access to the reports and images which will hurt their bottom line how quickly they "make an exception"