I'm curious what would happen if this breach occured in the US. We have severe penalties for these kinds of breaches outlined in HIPAA. I work in the healthcare

I'm curious what would happen if this breach occured in the US. We have severe penalties for these kinds of breaches outlined in HIPAA. I work in the healthcare industry as a software developer and know full well the costs for a single breach for the company. The thing about it is, there doesn't even have to be a breach per say. There just needs to be the potential for a breach for it to be considered. For instance, someone steals a laptop that has remote access to hospital records. That is a breach. Not because data was stolen, but because of the potential for data to be stolen. I don't know what kinds of privacy laws you have in the UK but if they are even remotely similar to here in the US, I will gladly watch google burn for this. Edit: Also, the fact that people are actually OK with a corporate entity free access to our medical records is appalling. Especially on a website such as this. I can't believe people are actually defending this.