If they found that people with no medical justification looked at the records (likely simple searches of computer files), there's nothing surprising or insane. This kind of thing can happen at any facility where someone famous shows up, either because of general curiosity or because someone wants to sell the information.
I've been working with computerized medical records for 30-odd years, and the thing is that once someone has access to patient information they're permitted to access any patient's information because on a given day any provider in a hospital may work with any patient. The understanding - and the law - is that you will never call up information that you don't actually need. Violating that principle calls for a draconian response, up to even criminal charges.
