You are profoundly incorrect. (Source, am a US physician)

First it does not say where the nurse works. Nor does it say he was ever a patient of hers. I don't know where you got that he was a patient of hers at an urgent care center.

Second, that is not at all how HIPAA works.

HIPAA protects against disclosure of protected health information (PHI).

Sending a picture of a condition to a friend or family member asking for their opinion does not constitute a patient/provider relationship. It does not make you a patient of an institution. And it does not generate PHI.

The nurse is an AH for bringing up and name-calling, he is an AH for threatening her.

ESH