The way that works (and in fact the way that classification of government secrets works in the US) is that this information is 'born secret'.
This information is has to be kept away from the public, including journalists, but there is no law preventing journalists from publishing information about someone's health. HIPAA doesn't cover journalists, it just prevents covered entities from giving journalists information.
I don't think things like GDPR and "free press" are in conflict like you think they are.... at least you haven't explained how they are supposedly in conflict.
HIPAA exists... and it doesn't prevent the press from using that information.
I'm not sure your really have a good grasp on what any of these laws actually do, let alone 'free speech'. You keep alluding to complications that don't exist and don't explain what you're talking about.
First, the company decides whether the request needs to be complied with or not, and if the user doesn't like that decision, they can complain to the regulators who may choose whether the refusal is worth looking into.
Then I'm going to store all the information I want, for the purpose of expressing it to others. Oh wait, I can't do that? Somehow the EU has a different definition of "freedom of expression" in mind than what the words actually mean.