We don’t know if access was logged, especially if they had an older system, but most modern systems certainly do. And when you get that “break-glass” dialog that forces you to put in your password and say “Yes, I really do want to see the information” and why...you would have to be a moron to do it.
Even an ‘older’ system logs file access at the sever level, not necessarily ‘who’ but ‘where’, what terminal and what record and for how long. All they would have to do is see who all was logged in at that location at that time...........