This is my life's work. I spent the first 6 years of my career developing the software as employee of the vendor used by the University of Iowa and the past 3 working for clients of the company in Houston and now Minneapolis. I've lived and breathed the software more than anything else in my life.
The University of Iowa could have prevented the firings. There's a piece of functionality called Break-the-Glass where if the patient's are marked as restricted, which should always be the case in high profile cases, the users would be presented with a warning message stating that they're about to access a restricted patient's record and that all actions in the system will be tracted and sent to an administrator. Basically, the user better be apart of the Care Team or they have no business being in the record and will be fired. Every single "curious" user would have backed out at that point. This functionality should be set up for every employee's record as well immediate family members if known. Of course the users are to blame as they broke patient privacy rules but this could certainly have been prevented.
Cedar Sinai in LA has a long-going problem. They're also a client of my former company. At first, they set up fake celebrity records and tracked those that accessed the records. They ended up firing some that actually had a good reason to access the records. Instead of this weird entrapment, they ended up just turning on BTG for every borderline celebrity and above. In fact, they have a department set up just to identify those that qualify as a celebrity.
Long story short: Users are to blame but Iowa should be held accountable as well because they could have set up more restrictions in the system in the first place.