"unauthorized access to patient medical records for the past two years by an employee" probably means, that someone two years ago had downloaded some patient da

"unauthorized access to patient medical records for the past two years by an employee" probably means, that someone two years ago had downloaded some patient data to a laptop, or maybe a thumb drive, probably for some legitimate work task that couldn't be accomplished on the authorized systems. Then the device was possibly lost or stolen.