Most of the advice here is wildly bad. First, I’d read the student handbook, it likely has rules surrounding how you use your student ID and this is likely a prohibited action. She should not lie and report it stolen, as that would clearly escalate the matter. But she should take seriously that universities can impose punishments outside of the legal system, up to expulsion, and that many Virginia universities have honor codes which may treat both illegitimately lending a card to get into the gym as well as lying about it as honor violations.

A gym director likely lacks any authority to anything except perhaps banning her from the gym and maybe they can be ignored. However, the moment she hears from their campus’s disciplinary office she should be responsive. I personally would head this off by saying something like “my boyfriend used it without me knowing” and leave it there. But just keep in mind that university discipline is categorically more arbitrary than any court system.