HIPAA violation or just terrible boss?

My girlfriend was cut by a patients fingernail while restraining him, he's autistic and had a violent episode. About a week later she had to go to the ER due to infection. The doctor diagnosed her with a staph infection/MRSA. She was given antibiotics and sent home. Her boss wanted her to stay home for the rest of the week. She went back to work Monday with no issue. Then on Thursday, while cleaning/resetting an iPad used by patients, she noticed a text message with her name in it. So she read it and others to find that her boss was discussing her staph/MRSA with her daughter and with the mother of the boy who scratched her hand. Is this not a HIPAA violation? They were also discussing terminating her in these text messages. Also, is it legal for my gf to have gone through those texts (which were synced with her boss' phone and her boss didn't know I'm guessing.) They are also accusing her of trying to scam her boss somehow and saying very derogitory things. No workers comp ins. Privat