IF what you said is provably true, there is no legal basis to sue you for reporting it: there is no liability generally for reporting or stating true facts, even if they harm someone, and also no liability for reporting criminal acts or actions which potentially endanger patients. However, if you can't prove that she did this, she could sue you for defamation: for making an untrue statement of negative material fact which damages her reputation. So if the investigation clears her, she may take that as support for a defamation lawsuit, since being cleared by the investigation will tend to undercut your factual assertion.