Hi Steve, sorry to hear about your friend's trouble; I thought I would add my two cents. First, with respect to GrnTea, the post is not entirely accurate. Tort law requires a breach of duty, a causation, and an injury. However, HIPAA does not fall under a common law tort scheme. HIPAA is a government regulation that imposes fines and penalties and not, as GrnTea implies, a private right of action in a malpractice suit (at least not yet). The government can fine both an individual and the hospital for a HIPAA violation, even if it is accidental and even if there was no injury. However, the government takes various factors into consideration when assessing a fine, such as whether the release was intentional and whether a party was injured. With respect to criminal penalties under HIPAA, they often do not apply to inadvertent release of PHI. Of course, this is all assuming that the lab results had patient "identifiers" on them.
Unfortunately, HIPAA hell is not the only thing she needs to worry about. The facility can punish her if she broke an administrative policy or procedure. Moreover, the State Nursing Board may decide to invoke disciplinary proceedings is she violated nursing ethics. As for the union rep, I don't see why anyone would not want a union rep in a disciplinary hearing with them. Even if the union rep sits and says nothing, the real advantage to having one is that you have a witness. I hope this helps.