That is entering the realm of criminal negligence.

This is not a simple data breach, there is stuff in there covering fraud investigations, suicide attempt documentation. This has got to be the most wide-ranging privacy cock-up I have ever heard of

Plus if this was accessible from a kiosk I HIGHLY doubt they properly segment this information internally either

A large number of heads (Including those going up the chain, supervisors, auditors, privacy managers) should roll over this one.