1. Consider this a lesson learned the hard way. Next time, do not access your friend's PHI without her having signed a ROI authorizing providers to discuss her care with you, and even then, you getting this information through the proper channels, i.e., from her providers and not by clicking in her EMR.
2. This may or may not be reported to your state BON. We have no way of knowing that. Rest assured that if it is reported to the BON, you will know about it as the BON will let you know they are investigating. If that happens, I strongly suggest you have an attorney to help you as the BON is not the nurse's friend...and yes, disciplinary action is public knowledge. You would need a lawyer to help minimize the damage.
3. Whether you are sacked or resign first, the fact is that future employers may still learn about this when they contact this employer to verify your employment. That is because, contrary to popular rumor, employers are not just limited to sharing only dates of employment and rehire status when it comes to verifying your employment. With a few exceptions that are covered by some state laws, employers can share any thing about your employment there provided that it is fact. You are/were being investigated for a HIPAA violation--that is a fact. That can be shared with the next employer if they chose to do so.
And don't forget the unofficial word-of-mouth, because nursing is a small world. You'd be surprised who knows who and where. And it's no violation for someone at your old job to tell their friend at your potential new job about this nurse they just fired for looking in her friend's EMR...
I sincerely wish you the best of luck in getting past this.