It would depend on exactly how the records were obtained. If hypothetically she paid a nurse $100 for it (and had done so many times in the past), that could be criminally liable. In practice, no-one would prosecute over a single x-ray. But when a reporter gets legally protected medical information "somehow", an insinuation that a legal violation took place at some point to effect that is not unreasonable.

Yes it is. And when it's a prosecutor saying that, doubly so.