She doesn’t have to disclose it was her. That’s hippa information. The only thing that needed disclosure was their contact with a Covid positive person
hipaa doesn’t apply
“Asking about vaccine status would not violate HIPAA but it is possible that other laws could be violated. For instance, requiring employees to disclose additional health information such as the reason why they are not vaccinated...”
and, same source,
“The EEOC confirmed “there’s no indication that there’s any federal law that would be violated by the employer asking this question.”
https://www.hipaajournal.com/is-it-a-hipaa-violation-to-ask-for-proof-of-vaccine-status/
if any employer, can ask, it follows a fellow employee can also ask and tell of themselves - those that ask just can’t say anything else after the yes or no response -they have to zip it. The ‘why’ is verboten. But an exasperated statement that doesn’t really request or expect an answer, like, why didn’t you tell me so I could take precautions? should be just fine, whether it’s a coworker or friend or family. But making further comments would also be verboten because in the workplace you’d trigger harassment rules.