OK, this advice has a pattern of escalation that should be followed. You WANT him to run his mouth before he realizes it's a trap.

You need a massage place in a town over to call him for a job reference. The call needs to be recorded or if not a single party consent stare, for it to be on speakerphone with others in the room. When he lays it all out, whatever it is he says, that's concrete documentation of what he's doing. It's no longer rumors.

Get him to spill as much info as possible, including first names or descriptions of clients. You want him to gossip with whoever is running that call. Describing just how scandalous and abhorrent the behavior was.

Get the local busybody and/or small town journalist to connect with him saying they've heard rumors. You want him spilling names... supposedly to provide validity to his claims... but actually to violate HIPAA.

What are his vices? Who are his friends? Does he get drunk and get chatty? Take advantage of that to get him to run his mouth.

get him to name the patients in question, at least 1 of them, who support these allegations. Then File a HIPAA complaint. This guy is discussing things that happened with his patients. He shouldn't even be naming his patients. Naming his patient is a HIPAA violation. Describing the circumstances of a patient in a small enough community that would make that patient identifiable is a HIPAA violation. You don't have to know if the things this guy is saying are true, or if it's actually a HIPAA violation... you just have a reasonable suspicion... especially since you just provided him with all sorts of opportunities to indulge in HIPAA violations. Possibly on

Then, contact your g/f's college and all the other colleges nearby. You want in-person meetings with the Chair of the department, and/or alumni resources or the department thay helps graduates get jobs. They will be able to warn other local graduates away from working at that place. And they will need her side of the story (and yours describing the history of this guy doing this) if there's any chance they might act to revoke her degree or certs. You want to get ahead of any potential negative impact there.
It's also possible that her college may be able to provide reduced cost legal assistance regarding a review of the non-compete.

Then, what licensing board is this guy operating under? I assume his entire practice and possibly himself individually have to be licensed? Make sure that licensing board is aware of these claims. It's possible that if he didn't file with the board, disclosing the potential incident so it could be properly investigated, and 'actually has reason to believe that it's true', that he could be in violation of things and his licensing could get fucked up. He may have a duty to report, or be a mandated reporter for these patients who may have delicate circumstances. If he hasn't actually reported correctly, he could be in trouble.

Also document all the other known situations he has done this in. What is the history of him 'knowing that his employees tend to sleep with their clients,' (you have to assume in this line of questioning that he's being honest. I think it'll get your further.) and what measures has he put in place (or failed to put in place) to protect his employees and his business's clientele?

Now you file a complaint with the city council. You want the shameful history of this guy's business out in the open. He's basically running a brothel with how many of his employees have done the same thing over and over. You want him shut down pending the completion of the ongoing investigations by these different agencies.

File a complaint with adult protective services. Bring to their attention that this guy has a business with a history of his employees sleeping with their clientele. That you know some/many of them are elderly or have other mental capacity issues (if true), and this may be part of elder abuse or abuse of other protected people.

The results of all these things can both put him in a world of hurt AND provide the documentation you need to successfully sue him.

All these things in place, you now sue him personally and his business for libel and slander. Your lawyer can walk you through getting discovery done for the reports he filed at the college and whatnot. But most of the documentation of him for sure sabotaging her and others has already happened as you led him into HIPAA violations. And as he describes how he has not failed to report, his clients have not been abused, and his business is perfectly legitimate and this really isn't a problem, he hopefully will then contradict himself about his previous statements and prove himself to be spreading falsehoods.

You want him to first jump fully on board with the falsehood, and then jump fully off and deny it.

This is when you connect with your labor board in your state regarding the reference he gave to the potential employer. And this is when you provide the documentation of his allegations and retractions and statements regarding his ex employees to his licensing board(s). Any of them. For any businesses that he owns or runs. There are usually standards of professionalism individuals are expected to maintain.

You want liens on his assets ahead of the major financial impact of legal fees and potential bankruptcy. So get those filed along with motions to freeze any asset transfers ahead of judgements.

If you can get other ex employees to join in the lawsuit, that could be very helpful.