Who would you have thought that the hospital -- or any hospital -- needed to make explicit in a memo or training program or something that snapping pics of patient injuries and posting them to the Internet is prohibited?

The folks that wrote the HIPAA regulations thought that - they require privacy and security training for all employees (I believe that it's an annual requirement, actually). So there's no way these people couldn't have known that this would be a problem.