University is refusing to delete medical records I (in error) had my old doctor send to them, claiming that deletion is a HIPAA violation--is this correct? how can I appeal? their security system is garbage and i worry about data hacks that expose my

Title. State is NY. I was under the impression individuals could petition for their private medical records to be deleted. I no longer attend this university and the medical records in question were not collected by the institution or relevant to any treatment I received there. Any help?

data delete deletion error hacks hipaa medical old petition privacy private question security send state system under university