It's not on the same level at all as medical records, but I remember years ago when I got my first "real job" working as a credit adjuster at a major credit card bank that you've definitely heard of.

Any employee could just search the name of a celebrity who was a card holder and view all their transactions. Not sure if that's still the case, but the only point I want to make here is that when this was brought up internally as a security issue, the top management clearly didn't care and did nothing about it.