I am sure the law sees the difference. Intent is what makes the difference between a murder charge and the death penalty, and supervision with a suspended sentence for manslaughter, when you hit a person driving drunk.

Page 346 was an accident - your intent was to read Your data. In viewing Further pages, as the OP stated for the explicit purpose of viewing other people's confidential medical data, the intent is a crime. It's the same thing as walking up to someone's desk in an office you're allowed to be in, and looking through their files.

You didn't know for sure that page 346 would have private data, and that you'd be able to turn the page; but there was a reasonable probability that you would in fact see private data. If someone died instead of having their privacy violated, it would certainly be classified as manslaughter (i.e., you were doing something you knew might be "dangerous") rather than just a plain accident where there was no fault.

I don't know what the actual law is, but given the benefits to society of "good people" reporting this kind of issue, I think that toying around with something like that should be considered not a crime at all, rather than being considered a lower-severity crime.

I never claimed page 346 was breaking the law. I claimed after you discover that the action reveals private data, and you repeat that action a bunch of times for the explicit purpose of getting more private data, you are now a criminal. This is what the OP very clearly stated he did.

He did not report the issue after finding it. He abused the security hole for his own benefit. He is a criminal.

Low severity? In civil court, they can take every penny he has, every penny he'll ever earn, and his house. In criminal court, he can be charged with unauthorized access to a computer system, one charge each time he did it. And he did it a lot, and they have logs. Which is all literally in his post.

Viewing other people's medical information is not a low severity crime btw.