It almost certainly both training & process related within Serco.
When I was in the health service in laboratories, we could access results (& basic clinical information) for the samples we were processing.
This also meant we /could/ access results for our family, neighbours and celebrity patients - but anyone doing so could expect to be given their final payslip very, very quickly (and if relevant, reported to the professional body).
There were regular audit checks on random staff to see what they were accessing. We didn't catch many individuals, but word got around very quickly when we started!