In a general sense, a signature or statement is said "non-repudiable" if the maker can not later retract it (i.e. challenge the validity of that signature/statement). Most signatures are repudiable, requiring some sort of additional proof to hold upong challenge (such as forensic analysis or the employment of a notary). This expressions have different meaning in different contexts, though:
According to this paper, in the cryptographic literature "non-repudiation" means the digital-signing algorithm is not breakable, so a third-party can not forge your signature. Assuming that, in your example, the nurse digitally signed the e-mail through [cryptographically] non-repudiable means (ex.: a PKI certificate), then the hospital can be confident that the e-mail was genuine - and the nurse can not later deny having sent it. (in other words, "non-repudiation" is a desirable property of a cryptosystem)
For this to work in practice, however, other factors should be taken into account:
- Were the keys propertly exchanged? If asymmetric encryption were used (such as RSA), the hospital must be confident that the nurse's public key is the one they have - and not someone else's key. If symmetric encryption were used (such as AES), then both should have the same key (a "shared secret") - though it's rare to implement digital signatures that way, and it's not without drawbacks.
- Are the keys secure? How likely is it for someone to steal those keys? It doesn't matter if the algorithm is non-repudiable, if someone else had access to the nurse's key then this same person can sign messages impersonating the nurse.
On a legal sense, however, the term "non-repudiation" means something completly different: if for instance your credit card bill contains items that you didn't buy, under some circumstances you have the right to "repudiate" it - and the vendor is required to prove that you did. This distinction is important, since as the last bullet point showed, even if you use a non-repudiable algorithm to do the signing, you might still have the right to repudiate it (i.e. the nurse could claim s/he didn't wrote that e-mail, even though it was signed with his/her key).
Who would have the burden of proof in this case, that is a legal question (making non-repudiation sometimes desirable sometimes not, depending on the party involved), and that has nothing to do with IT - except in the sense that your policies should be designed with the right context in mind (should I use digital signing in the first place? how strictly should the keys be handled? etc).
Main source: this paper by C. Ellison and B. Schneier
See also the Wikipedia entry on the subject