HIPAA, in particular 45 CFR 164.512 describes circumstances where patient consent is not required for disclosure:
A covered entity may use or disclose protected health information
without the written authorization of the individual, as described in §
164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section,
subject to the applicable requirements of this section. When the
covered entity is required by this section to inform the individual
of, or when the individual may agree to, a use or disclosure permitted
by this section, the covered entity's information and the individual's
agreement may be given orally.
Standard: Uses and disclosures required by law.
(1) A covered entity may use or disclose protected health information
to the extent that such use or disclosure is required by law and the
use or disclosure complies with and is limited to the relevant
requirements of such law.
(2) A covered entity must meet the requirements described in paragraph
(c), (e), or (f) of this section for uses or disclosures required by
"Required by law" is defined in 164.103 as
a mandate contained in law that compels an entity to make a use or
disclosure of protected health information and that is enforceable in
a court of law. Required by law includes, but is not limited to, court
orders and court-ordered warrants; subpoenas or summons issued by a
court, grand jury, a governmental or tribal inspector general, or an
administrative body authorized to require the production of
information; a civil or an authorized investigative demand; Medicare
conditions of participation with respect to health care providers
participating in the program; and statutes or regulations that require
the production of information, including statutes or regulations that
require such information if payment is sought under a government
program providing public benefits
It would be "required by law" in the case of "subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information". But Congress is not a court, grand jury, inspector general or administrative body authorized to require (Congress cannot require, it can only legislate: the Executive Branch requires).
45 CFR 164.512(e) allows disclosure
in the course of any judicial or administrative proceeding, but a Congressional hearing is neither.
Since such disclosure would be in violation of the law and knowing disclosure can result in a a criminal penalty of up to $50,000 and up to one-year imprisonment, the physician cannot be compelled to testify since the doctor has a 5th amendment right to not incriminate himself. Congress cannot grant prosecutorial immunity.