Based only on what you have written here, there is no HIPAA violation - although there may be some poor judgment and violation of professional boundaries.
I personally would not expect a student to fully understand these things; correction and education would be in order rather than exaggerating the offenses to the level of HIPAA violation.
In case you aren't sure what I mean regarding judgment and professional boundaries:
Nurses need to avoid the appearance of impropriety. Being a patient is widely considered to be a "vulnerable" position. Therefore, becoming friendly with a former patient is often called into question. There are many reasons (beyond the scope of this topic) why it is probably best to wish patients well and let the relationship end when you are no longer caring for them - especially when you have neither the wisdom nor experience to judge the situation any further.
Next, because patients are vulnerable, we take extra cautions with our interactions with them. What if the patient didn't really wish to continue a relationship with you or have you visit but simply felt the need to be "polite?" Or, worse, what if s/he felt it was probably best to treat nurses/students this way, fearing poorer care if s/he didn't allow this kind of relationship? As the ones acting in a professional capacity (which also has an ethical code associated with it) we are responsible to not put patients in those kinds of situations. Generally-speaking, we are there to concern ourselves with patients, not to have them concern themselves with us (aside from not abusing us, etc), or become concerned that they must allow certain things in order to receive good care.
You may feel that you had an understanding with the patient, you both felt comfortable, and you shouldn't have to worry about these types of things. I don't know what else to say except that, too often, that just isn't the world we live in.
I'm sorry this has happened to you. I don't know what you can do from here - although I can't see how you have anything to lose by throwing yourself (with or without a lawyer's help) at the mercy of your program. They have acted harshly because they took the hospital's word regarding their investigation of this matter. Sure the patient didn't say your son was his visitor - because he took that question to mean one thing and the hospital used it to mean something different. Anyway, your program wants to show the hospital that they take these concerns very seriously so that the hospital will continue a business relationship with them - which is kind of a big deal because they do need clinical sites.
Have you thought about all of this?
What communications have you had with your school? What have you said in your defense?