While the answer to rlcarey's question is critical, I'll put up this
link up to support some of his concerns. There is no specific penalty attached to disclosures related to SAR filing; a prosecutor would have to figure out where it "fit." However, it would undoubtedly be considered an intentional violation for the individual. (It might be for the bank as well.) Your safe harbor should be intact.
Loose lips sink ships, but they sink careers too. That should be the thing your employee should understand first; i.e. she's not waiting to find out what your regulators decide, she's waiting to find out what
your bank decides.