I'm sorry for your loss. I cannot imagine what it would be like to lose a son.
What you should know is that there's no private right of action for HIPAA violations. If it were YOUR info that was disseminated in violation of HIPAA, you would not be able to sue for its violation. The state can impose modest fines for HIPAA violations, but individuals can't sue.
If you feel your son's privacy was violated, you can complain to the hospital and to the governmental agency that regulates the hospitals in your state. But I see no civil action available here, at least under general principles of law.
Don't take that as legal advice, since I don't hold Nebraska licensure. It's simply my two cents on the facts you present in light of general principles of law. If you need legal advice, please consult a lawyer who holds Nebraska licensure.