As someone who works in an industry that deals with HIPAA-oriented concerns constantly, I’m consistently amused by how many people think that HIPAA means “I don’t have to tell you shit about fuck with regards to literally any medical stuff I may or may not have”.
Honestly, in your shoes, I’d actually try pretty hard to get her fired, because she’s going to kill someone with her negligence.