Yeah the sticker sentence especially. That's essentially the same as saying that the kid got the shot. HIPAA doesn't say "it's ok to reveal private health information as long as you do it in a wink-wink manner." Revealing personally identifiable health information is forbidden no matter how you do it.
Even agreeing that her son was at the doctor was a violation. We can't confirm or deny that a potential patient even came to the building for health care.
See now, I decided I could read that as "your son deserved a bravery sticker for having to bear up with you as a mom."
Since the mom made the visit itself public, and lied about the conversation, and the nurse didn't specify what either person DID say, nor what actually was or wasn't done, I'm not sure any new information was revealed. Implied, if you want to infer it, but not stated. And for the mom to sue about it, she'd have to publicly admit to her own lies....
I know lying isn't against the law. (Although I'm neither a legal nor medical professional.) I meant she would be deterred from suing because the extent of her lies would have to be aired in court, in public, in order to prove the nurse revealed information.
In the case you linked, the nurse posted information about a rare case (ergo easily identified) whereas in OP's situation the publicly identifying information had already been revealed by the mother and the nurse didn't specify any new facts about the case itself. She might still get in trouble but it's less cut and dried than the case in your link. Imvho.