I worked as a state and Federal surveyor for several years, and once investigated a v. similar complaint that was made to my agency -- a person had been admitted to a hospital for a very private, sensitive reason, and a family member who was an employee of the hospital looked up the records and shared the info with other family members without consent. The hospital promptly fired the employee as a result of their own, internal investigation after a complaint was made to them
HIPAA is serious business. I second what others on this thread have said about carefully considering what you want to do, and the long term ramifications of whatever action you take. However, keep in mind, also, that what she did is a v. serious violation of Federal law
. If you choose to complain to the Feds about the HIPAA violation, there are serious penalties (fines) for confirmed violations, even unintentional ones, and there can
be prison time
(plus fines) for intentional violations. If you report this to the facility's HIPAA compliance officer (yes, every facility is required to have one), she will probably get fired for that blatant a violation. You can also report her to the state Board of Nursing and complain to the state agency that licenses hospitals (that was the agency I worked for in my state -- it's called something different in every state, but is usually a division of the state Dept. of Health and Human Services (or whatever that's
called in your state
I'm v. sorry for your loss -- best wishes.