Now that I missed. Where's that exactly?
From the text of the memorandum:
1. Initiate appropriate rulemaking, pursuant to your authority under 42 U.S.C. 1395x and other relevant provisions of law, to ensure that hospitals that participate in Medicare or Medicaid respect the rights of patients to designate visitors. It should be made clear that designated visitors, including individuals designated by legally valid advance directives (such as durable powers of attorney and health care proxies), should enjoy visitation privileges that are no more restrictive than those that immediate family members enjoy. You should also provide that participating hospitals may not deny visitation privileges on the basis of race, color, national
origin, religion, sex, sexual orientation, gender identity, or disability. The rulemaking should take into account the need for hospitals to restrict visitation in medically appropriate circumstances as well as the clinical decisions that medical professionals make about a patient's care or treatment.
2. Ensure that all hospitals participating in Medicare or Medicaid are in full compliance with regulations, codified at 42 CFR 482.13 and 42 CFR 489.102(a), promulgated to guarantee that all patients' advance directives, such as durable powers of attorney and health care proxies, are respected, and that patients' representatives otherwise have the right to make informed decisions regarding patients' care. Additionally, I request that you issue new guidelines, pursuant to your authority under 42 U.S.C. 1395cc and other relevant provisions of law, and provide technical assistance on how hospitals participating in Medicare or Medicaid can best comply with the regulations and take any additional appropriate measures to fully enforce the regulations.
US Code title 42 details the spending of government funds in the pursuit of the public health/welfare. Basically, you are correct in saying that a government mandate to do something violates the 10th amendment. For the same reason the government can't really punish or sanction a state (although that is a little bit foggier). What they can do is provide incentives for following their directives. And this is true of any "Department of x". Their regulations are not laws, but rather the restrictions you need to follow to get government funding. By agreeing to take government funding, whether it be for education, transportation, or Medicare and Medicaid, the institution the government endows must agree to comply with certain rules of behaviour set by the government. This is why this regulation affects only hospitals that accept Medicare and Medicaid (which happens to be most of them). They are free not to comply, but the government endowment would be withdrawn.
And there are a number of private institutions that do not take government funds precisely because they want to set their own rules. To force them to change their behaviour would take an actual new law. However the ones that have agreed to be under DHHS oversight, must either comply or forfeit their endowments. This process is also mirrored on a state level. It's like the difference between public and private schools. E.g. As a child I was sent to private parochial schools full of prayer and terrible education standards. Which is perfectly within their right as an institution not accepting government funds and therefore not subject to the regulations of the Department of Education.
Now the balance to the governmental "power of the purse" as it is called, is that if DHHS ever demanded something that hospitals felt would be too harmful to their business or ethics they are free to withdraw. And for every hospital that withdraws the government loses power (since the basis of this power is in the advantage gradient created by the influx of government funds), and most likely the trust of the institutions and people involved. If ever a majority of hospitals withdrew from government funding something like this would have no power. However, I would be very surprised if so much as one institution cuts off its own funding rather than follow this regulation as there is essentially no cost to doing so.