Earlier quoted context omitted.
Celebrities get special treatment in hospitals built into pretty much all EHR software. Names are obfuscated, while searches and views get instantly flagged. I highly suspect the same thing exists here.
That's to protect the hospital. Inappropriate access to any medical record covered by HIPAA carries the same weight, it's just less of a legal shit show and less tempting for employees when they aren't rich powerful or famous.
Any employee could just search the name of a celebrity who was a card holder and view all their transactions. Not sure if that's still the case, but the only point I want to make here is that when this was brought up internally as a security issue, the top management clearly didn't care and did nothing about it.