Precisely. I once handled the account of a Major League Baseball player - and not some benchwarmer but a recognizable player who was a starter for his team - and had access to not just his annual income, assets & expenses (which, theoretically, for any customer could include health care benefits or costs) but also his SSN, address (present and past), number of dependents, marital status, etc. Everyone gets annual privacy training in my industry, as happens in the healthcare industry, and we are constantly reminded about different levels of information and especially protecting sensitive personal information. There is a lot we could learn or know about our clients and none of it is anything that I would be allowed to reveal to anyone outside of our organization - and even within our organization, the question always needs to be asked "does this person have a business need to know?"
This information breach against Kate is a significant attack on her basic, human right to privacy and I'm appalled that anyone working at the London Clinic would be willing to violate that for any reason.