And I'll also say, that even when I started 20+ years ago, there was some level of audit trail for everything I looked at. We had a similar but smaller scale incident then, when a prominent doctor was admitted in the hospital (for cancer treatment if I recall.)
They asked for an audit of their records, as what should have been private info was flowing freely as gossip, and they found several folks that did not have direct care responsibilities had looked at notes they shouldn't have.
Several people lost their jobs over it, and I could have been caught up in it, had it not been for a good manager that I worked for at the time. I'd been approached by the nursing supervisor and asked to keep an eye out early on while making my rounds (working security then), because the doc felt uncomfortable. When I did a quick report on it later (we did report on stuff for both documenting and justifying our time), I wasn't 100% on the room number and spelling of the Docs name (hyphenated and unusual), and I figured the report might get looked at by upper management later if it became an issue. So, I looked it up, but didn't view anything (though I had some additional access available because I worked multiple positions for the hospital.)
After the audit my manager pulled me in, and basically very vaguely asked if I was aware of issue. I said yeah (but not initially thinking about the access audit yet), in fact I filed a quick report on it when I was working a shift, and I'd tried to keep an eye on it, but didn't see much unusual activity.
He didn't ask any other questions, but he said he was behind on report review and to go get a snack, and give him some time to catch up.
He looked at the timestamp of my access to the basic demographic info (name spelling and room number), saw it was within minutes of my report filing, and that was the end of it he told me a little more later once the terminations started, as we had to standby for them, and that's when the audit thing came out. But, I got the impression if I hadn't been writing the report, I would have been gone also.