Just when you think things are going well, the CEO brings you a letter from the Office of Civil Rights. The OCR is investigating a complaint by a patient that received a visit from one of the hospital employees while being a patient in the hospital. The hospital employee just wanted to wish the patient well, but was not part of the healthcare team. The patient wants to know how did the hospital employee know about the patient and the patient's condition. Although this is a small town, you ask your IT department to do an audit of the patient's electronic medical record and see that the hospital employee had accessed the record, although the hospital employee was not part of the care team. The CEO says, "well, it is a small town and everyone knows everyone, or someone is always related to someone else, etc." Whats the law and the implications of this conduct. What action should be taken and why