Posting patient information on social media is a HIPAA violation if you do not have the patient’s authorization because it discloses individually identifiable health information to the public that could be used to commit fraud or identity theft.
“Yes, I’m VaxBatCrazy59’s son, and I would like to purchase this motorcycle. My identification? Of course, it’s all right here in a now-deleted facebook post. You can confirm with NightNurse1985. Of course, i’ll wait.”
This even specifically says there’s nothing in HIPPA that mentions social media. This (law? Policy? What is the . . crime? . . again?) has all the solidity of soup.
That's not the issue. You can not in any way state or imply anyone that could possibly be identified in any way has even been through your health facility's doors, unless compelled by a court order, with some mandated reporter exceptions. This would be suspected child abuse, or someone may be a danger to self or others. CMS and OIG/federal register websites go in depth, on technicalities. The article doesn't say who the nurse was, but yes, she or he didn't even put a name. The issue is consent, and even that doesn't matter with employers. That nurse jeopardized the whole practice being shut down and/or sued.