I am very familiar with HIPAA breaches and what happens when you have one.
The consequences for a facility are severe. Those consequences can be mitigated by swift action.
It is very hard to believe that the source of a leak won’t be identified and the leaker terminated in 48 hours (only because it’s a weekend, 24 hours is normal).
If the source is a person with a license (a nurse, a doctor, a therapist, etc) they are also going to lose their license.
The catch-22 is that terminating the leaker in 48 hours confirms the story.
-PJ