Highly doubt it's a HIPAA violation. But that doesn't make it right. Rather than going in guns blazing, I would simply point out that this information is private and potentially embarrassing and to request that they change the policy to one of just recording it in writing and any student who wants to see the info can ask to.
I would also check to see why this is being done. I know that in my state there is a law mandating BMI screening at periodic intervals (I think it's every other year or something) but we get a notice beforehand explaining that it will be done, why and when it will be done, and how to have our child opt out if desired. The nurse does it in her office and all records are private. You get a letter in the mail with the results, and I think that if your child's BMI is out of the average range, there is some additional generic info and a recommendation to consult with your child's doctor.
In the absence of some kind of law that mandates these kinds of checks as frequently as your school district is doing them, I would push very hard to have this practice abolished entirely and would have my child opt out just to make a point. There is no need for the school to be collecting this data with the frequency that they are doing.