From what you have written about, you need to consult with your health care provider as to minimizing your step son's birth mother from accessing your family's insurance information other than that of the step son.What the birth mother did was probably not against the law, but was somewhat intrusive in looking up information as to medical information as to your family besides the step son. I suggest that you and your husband speak directly with the birth mother as to your feelings that your privacy was invaded.