Patient privacy would not be an issue if someone was comitting a criminal act against a helpless patient. Which is what the nurses are stating.
the nurses had suspicions, not proof. none had personally witnessed him injecting or abusing her. they could only report her condition after his "visits".