Parents tend to assume that camps are subject to the same privacy laws as schools, such as the Family Educational Rights and Privacy Act. In reality, FERPA only applies to programs that receive federal funding. While some programs for minors on college campuses might fall into that category, most summer programs don't.
Likewise, families often assume that their camp infirmary or medical center is subject to HIPAA, but usually it's not. The privacy protections of HIPAA are intended for medical centers that bill insurance companies online for their services, which is not something most camps do.
Do state laws offer greater protections? Are camp policies regarding their campers' data sufficient? Here's a thoughtful article exploring these and other questions related to data privacy at camp: Summer in Cyberspace: Protecting Your Kids' Digital Privacy at Camp by Leah A. Plunkett.