I know your friend says she’s already called a lawyer and gotten nowhere, but I think she needs to call another one.

She can’t sue for HIPAA violations, because there’s no cause of action in the law that allows for it. But she can sue for other torts like breach of confidentially.

This is a strikingly similar situation where the victim tried to sue for HIPAA violations and lost their original case, but then changed it to breach of confidentially on appeal and was awarded almost a million dollars.