idk, I would say that at least in healthcare, most people are sufficiently terrified of the consequences of HIPAA violations that they won't access records they aren't supposed to. In this case, what works is a combination of serious, career-ending consequences and the knowledge that compliance departments conduct regular audits of everyone's access logs.