Report the incident to the organization.
Inform the patient about the breach.
Ask the unauthorized personnel to delete the information.
Ignore the incident unless someone reports it.