> seeing a bunch of other patient files just left on the desk in eyesight ...and then proceeding to rifle through a bunch of those files to satisfy your curios

> seeing a bunch of other patient files just left on the desk in eyesight ...and then proceeding to rifle through a bunch of those files to satisfy your curiosity. Finding a vulnerability and reporting it -> Good Continuing to exploit the vulnerability after you've found it just to satisfy your curiosity -> Bad