I have some friends who work in a medical facility. They get an extreme amount of training on patient privacy laws and constant reminders not to get sensitive patient information on to their personal devices.

Despite the intense training and constant warnings, it happens constantly. And that’s just the cases they know about and address.

You have to be able to trust your staff, but you also have to be realistic that any organization at scale will have people who either don’t care or don’t think and it happens frequently.