I would not be upset that she saw the records. At our Drs. office, I signed a form that gave access to immunization, I think others have talked about it. It's not illegal for people to look at them, actually it makes some situations much easier, like playing sports outside of the school etc.
BUT, BUT, isn't there always a BUT, you need to talk to her about directly addressing your son with this problem. Hopefully DH will understand once you calmly explain why this is so wrong.
MY son is very close to my mother and father. My father told him tons of stuff before he passed. This little 8yo knew where his money stash was. SO wrong on many levels. Fast forward a few years and now my Mom is telling his stuff he doesn't need to know. Personal family stuff, friends lives stuff, really bad. I finally sat down and told her that my DS was the only person who visits her on a regular basis and does tons of work for her. He love to sit and do puzzles and watch TV with her. He is a teenager. This is really sweet and not common. I had to tell her if she continued to tell him all the stuff, his visits would stuff immediately, NO SECOND WARNING. She has slipped a little here and there, not enough to follow through, but enough to give her the "I know" eye. THIS is what I think you are headed for if she shares things already with him. Talk to your DH about this, use me as an example etc... My son knows when I became sexually active, when I took my first drink etc, things I did growing up. HE doesn't want to know, she overstepped the line.
Good luck, as I said, I would use the immunization as an example but ultimately she needs to have a grandmother/grandson relationship with him.