But that analogy is letting someone access the filing cabinet, and not taking reasonable precautions not to. Which would be a direct violation. Which may or may not be the case here.