I believe they have The Data Protection act but it is not as strict as HIPPA. You can release information to family members, which actually makes sense.
They probably would have/had a hard time considering this a violation. (Especially considering that the nurse who killed herself just transferred a call) She (the other) did not sell or leak info to a tabloid. Not much more was said than what had already been released by the Royal Family in press statements. It was already out there. And it seemed more info given on basic treatment than the condition. The media was hyping it up into a scandal and creating more of an expected back lash.
It was a security violation more than anything else. They should have had a code word in place. That was a fail on everyones part.
(Just to clarify)