Starting with your second point first, confidentiality in health care is much weaker than most people think and when public health is involved, it is (almost?) non-existent. Mandatory disclosure and contact tracing of sexual partners of people with STDs, for example, doesn’t care much about privacy.

And health care professionals have been held to have duties to third parties in many contexts – spouses and families of patients with infectious diseases, the employees and insureds where the examination was not for the individual’s benefit but the employer’s or insurer’s, people for whom the doctor-patient relationship revealed a serious and imminent threat of violence from the patient. Not all of those cases come out the same way, but many of them find a duty to a third party. They’ve got all the line-drawing problems that you point out – but, hey, if law were easy, no one would need lawyers, judges, or (heaven forbid!) law professors!