Reporting HIPAA violation

Such a violation is a serious legal issue and, like any other complaint against a staff member, isn't - and shouldn't be - discussed with anyone not directly involved.

Having never made such an accusation, I can't answer your question. So, just out of curiosity, in what way was the violation covered up and swept under the rug?

I agree. I was working when the patient and family were still in the hospital and were upset and making the complaint. Administration person (accused) says there is no problem because they have the right to know everything about all patients (even though this person is not involved with patient care). This person was called by another nurse on the unit to tell about said patient and personal information they have in common.  Hospital admin sees no wrong doing.  Our culture has turned into fear of retaliation. I believe in being a patient advocate. 

Reporting HIPAA violations is done through the office of civil rights. If you are not the person whose rights were violated, I don't know that you can actually make the complaint. If you were concerned about the patient, you could inform them that they have the right to make such a complaint.

I reported my employer's occupational health company for refusing to let me see my medical record. They were under the impression that my employer "owned" the record because they paid for it, and that I therefore had no right to see it. They were wrong. A lawyer was assigned to my case, who determined that the company had violated my rights. The company was forced to give me the record, and to re-educate their staff and rewrite their policies. They will now email you your medical record on the spot if you ask for it. They learned their lesson and corrected the error. 

I was advocating for myself and protecting my rights when I did that. If I saw a concerning HIPAA violation at work, I would inform risk management, and then let it go. I don't believe in starting witch hunts, and if I wasn't directly involved I feel like that's what it would be. 

It's the hospitals job to investigate, not yours. I would be wary of making accusations without direct knowledge of the situation and process. If the hospital is indeed "sweeping it under the rug" they will be corrected at some point thru audit and other oversight.

Just because you are not "seeing" anything done does not mean something is being done.  Since you are not in the involved parties you will not be privy to any ongoing investigation.  Your description of the situation is vague.  Some staff may need to have knowledge of all patients even if they are not a direct care provider.  Some roles may need to have staff access patient information for a multitude of reasons.

There may be repercussions that are on-going, or a review has turned up nothing.

I do not see a need to report as if you did, you still would not be privy to any outcomes.