My name isXXXXX have been a licensed attorney for over ten years and will be assisting you today.
First, you have not violated HIPAA by investigating on Facebook. Unless you posted medical information on his page or something of the sort, you have done nothing wrong.
Whether you go to the police or not depends on how real the threats actually are. More bipolar individuals are not violent, but this seems to be a potential exception.
Unfortunately, until he actually does something, or attempts something, there is not going to be anything the police can do.
I would suggest you first provide your findings to your supervisor and the administration. If they know they have a potentially violent individual on their hands with a violent criminal record
and an obsession with firearms, they may change their mind about keeping him admitted.
If you have more questions please feel free to ask. I'll be happy to answer them. If you do not, please do remember to rate my service in assistance to you today.