Quote from Ruthfarmer
Perhaps civil suits would result in hefty judgments. That might be what's necessary to make administration and staff take confidentiality seriously.
If you couldn't get a hefty fine out of the OP case, one that was basically open and shut then don't fancy your chances of doing any better in future.
Start prosecuting and dish out mandatory jail time. Making an example by sending offenders away for a few months with "Big Bertha" or I'm your cellmate "Mike" and you're going to squeal like a pig ought to send the proper message.
It's like Medicare/Medicaid fraud. Large hospitals or healthcare systems engage in it until they get caught. Then all they do is say it was an "error" and pay back some or all of the money plus perhaps a small fine. If a few CEOs, presidents and others in on the game were convicted and sent away, bet things would change.
Or, perhaps start hauling doctors, nurses and others in for hearings about suspending and or taking away their licences. That would get their attention as well.