VIC Privacy Law as a Third Party in Health Care Workplace?

I have a question from the perspective of a third party. I am a Chiropractor, and this relates to a patient(let's call him Steve) and their boss. I will give you the brief outline and then finish with my question.

The boss rings me about a medical certificate that was issued to Steve (I had been given consent from Steve to talk to his boss only about the medical certificate in question). The boss asked me if it was for a workplace injury / workcover claim (his reason for calling). I stated that it wasn't to the best of my knowledge. I thought the conversation was over, but then Steve's boss went on to divulge details about suspected theft by Steve of equipment at work and how his company was about to fire Steve based on the evidence (which wasn't really evidence by the way but I digress). He asked me to keep all of what he had told me confidential.

I did not mention specifics of this information to my patient during the course of that day, however later that night I received an email from the boss stating that he would seek legal action because he believed that I had told Steve details of our conversation. The email basically summed up our conversation- entailing details of Steve's medical information which was confidential, plus then basically repeated all the allegations that he made about Steve's ''theft''- however he CC'd the entire email to another person who wasn't Steve. It was an area manager who I personally didn't have permission from Steve to be in contact about.

My questions therefore are:
1. Is there a law regarding sharing workplace information attaining to professional conduct to a third party (ME) about a staff member (Steve) without Steve's permission? If so where can I find this law/legal info?
2. Has the boss also breached workplace confidentiality / Privacy laws by mentioning the professional conduct and medical information to another party (the other worker) without mine or Steve's permission?
3. Where does this leave me as to the privacy act for health care professionals- as I am now aware that his boss has shared this information with a third party. Am I obligated to contact someone now?