I believe the answer is: Accidental uses and disclosures are not subject to penalties provided reasonable safeguards are in place and there has been no negligence.
The purpose for such disclosures is to that ensure that the patients could receive prompt and effective health care. This could only be done as long as the establishment provided appropriate administrative, technical, and physical safeguards that does not further violate their privacy.