That's not the issue. You can not in any way state or imply anyone that could possibly be identified in any way has even been through your health facility's doors, unless compelled by a court order, with some mandated reporter exceptions. This would be suspected child abuse, or someone may be a danger to self or others. CMS and OIG/federal register websites go in depth, on technicalities. The article doesn't say who the nurse was, but yes, she or he didn't even put a name. The issue is consent, and even that doesn't matter with employers. That nurse jeopardized the whole practice being shut down and/or sued.