My friends ex husband started dating a medical receptionist shortly after their separation due to him beating and raping her, He has been convicted on the domestic violence and is currently out on bail in the Criminal sexual assault case.
During the time that she was going to therapy the medical receptionist illegally accessed her and her child's files 130+ times.
Is she criminally liable? She willingly admitted breaching security and was immediately terminated...

HIPAA law provides for penalties against violators. Most likely the termination satisfied HIPAA.

There are no criminal charges involved. And there MIGHT be a civil case, but only if they can prove damages.