If it's students, the first person to go to is their instructor. You would also notify the charge nurse on the unit where they were working. If it's nurses, as in staff, the person to whom to report would be the hospital risk manager and the charge nurse.
As to "Who pays the penalty?" the students will get penalized by their school, as they are bound to have had "the talk" about confidentiality. If the patient can demonstrate harm, the hospital will pay because they didn't make their policies on confidentiality clear enough to the school to have the school impress them upon the students enough, or, for an offense by a staffer, because they didn't supervise and train the staffer enough.
CMS levels penalties on institutions, not individuals. However, the institution can do whatever they have in their P&P book to the individual that caused the institution to have to pay up, like firing them.