Other than the fact she was able to take the photo in the first place I don't see a lot of issues here.
The Person who took the photo has been punished, by being fired, and was reviewed. Having moved to a new role in another facility either A) she has admitted and is being observed for similar behaviour, or B) the new facility is unaware, in which case they haven't done due diligence in their hiring process. Which of course leaves them open to legal action.
It is beyond the control of the original Medical facility to further punish the nurse, it would need to be a legal act next. If there is a failing there then that should be addressed.
The Victim in this case should take legal action against the facility to ensure the facility puts in place adequate training and procedure to ensure this sort of behaviour does not re-occur. Plenty of jobs do not allow personal phones in certain areas. This would be relatively easy to manage.
The Victim's Trauma should be addressed in the above legal action. Outside of that is there any evidence that the image still exists or has been uploaded to the internet? Was the nurse asked and did she then delete the image?
This is an unfortunate incident, brought about by the disruptive technology(I bet if she had of bought an actual digital camera in, questions would have been asked). If correct process and procedure was in place in the first place this wouldn't have happened. This is an area where I believe most corporates fall down in, until they get sued for it. After which they start to take notice.
As to the scare-mongering around "paedophiles" and the like. That is FUD. What exactly beyond baseline Process and Procedure(and actually following it) would you suggest that would "catch" a sophisticated conspiracy. (Noting that an "unsophisticated" conspiracy is probably going to fail before it even gets off the ground).