A healthcare provider in New Mexico faced a $2.3 million penalty last year. The reason? Patient files were accessible to unauthorized staff members. This wasn’t a hacking…