By Amy E. Feldman

PHILADELPHIA (CBS) - By law, how confidential is your medical information? Not as confidential as you may think.

Five more Missouri women have just joined a lawsuit, bringing the total to 17 patients who sued their cosmetic surgeon, whom they claim posted their full names and before and after pictures of them, naked from waist to chin, on the internet to highlight how good the surgery results were.

I guess all that “I’ve just been doing a lot of Pilates” talk is not going to fly anymore. But is it illegal?

Under the Federal Health Insurance Portability and Accountability Act (HIPAA), medical records maintained by health care providers and health plans require privacy in the maintenance and electronic transmission of records. But employers, who may receive details about your medical condition for leave are not governed by HIPAA, nor are your child’s school records, or information contained in your financial records like credit card bills with information about your cosmetic surgery price tag.

But the more frequent release of medical information comes when you agree to let the doctors disclose info to your insurance company and others – in the forms you sign without reading when you visit the doctor. And if someone tells you to strip from the waist up while holding a camera, ask questions before doing so about the C word. (Confidentiality, not cup size!)