This doesn't add up.
According to the article the person or persons accessed the records and tried to sell them, so likely gave an indication to the buyer what was in them. The records were "disclosed to a third party", so we have no idea how many people were involved (if it happened). This "investigation" was in March 2024, so what's happened since then?
Whether the person or persons lost their jobs and are now unemployable is irrelevant. The London Clinic and ICO both laughably claim that this "sad incident" has been appropriately dealt with, and there's insufficient evidence to support a prosecution. Reader comments are scathing and say the people should be prosecuted, and the accessed records might be published abroad.
I think this story is gaslighting, as it makes no sense. Deflection for something else? It's possible it didn't happen at all, and certainly imo not in the way it's been reported.