The same problem existed in patient data prior to HIPAA. It still happens, but the unauthorized disclosures have gone down due to automated trips. It used to be your check in clerk could run any reports on whomever they wanted without giving it a second thought.