Unjustified access to medical history and confidentiality of passwords.

Access to medical records, without being justified by a healthcare reason, is a violation of data protection regulations. Passwords must be confidential. The data controller must be able to unequivocally determine the specific person who accesses the resources of the system that contains personal data.