You can report this to the Privacy Officer at the hospital your son was treated at. They can easily see who accessed your son's records. Mail a letter to the Privacy Officer that you believe your son's records were accessed without authorization by so and so and you want them to review his records. You might also be able to find the Privacy Officer's email on the hospital website. If she did indeed access your son's records, also file a complain with the Privacy Officer of the hospital she worked in.