In IT systems that I’ve been a part of that manage HIPAA data, there are access controls and audit trails required for compliance. The fact that the victims are receiving calls within mere hours of posting the request should make a very short audit trail. What will turn up is either the perpetrator’s user account, or possibly a non-related worker that had compromised account credentials (username/password). Even then it will show access from a specific IP address, and that IP address can be audited back to which piece of hardware (desktop, laptop, tablet) had that IP address at that time. From that point there are cameras and timeclock tracking.
Since this has happened more than once, it is unlikely the exact same staff has been working at the same time for all the recorded incidents of leaks. Its a process of elimination problem at that point. Example using fake names of workers:
Leak 1 workers:
Brie
Noah
Fatima
Dennis
Leak 2 workers:
Noah
Fatima
Dennis
Maria
Leak 3 workers:
Brie
Dennis
Maria
Sofia
Leak 4 workers:
Dennis
Maria
Sofia
Miguel
The leaker is Dennis as he is the only worker that was there on all 4 shifts when the request came in.