When I worked at a health center we totally had this kind of thing audited. The company lawyer would review for any unauthorized access and she would fire people on the spot for violation of HIPAA.

It may be time for you to get lawyers involved.