The rule I proposed
Years ago, that each access to your healthcare record must produce a line in a report to you which is given to you by default would have fixed this.
Who looked, at what, why did the say they did, what is the right they assert to do so.
And optopts were not requests!
They were orders.