Medical records have caused the same problem. The way you combat this type of misuse and invasion of privacy is fairly straightforward:

• All electronic records systems must have audit capabilities. In medicine, this is required under HIPAA.
• Perform targeted audits over high profile cases.
  
• Perform random audits with enough frequency to potentially review all staff with access on an annual basis
• Transparently conduct audits for any and all complaints of misuse
• The most important: Have a zero tolerance policy.

This type of approach is not perfect, but it puts enough negative pressure on the problem to really make staff think twice before entering the record of someone they shouldn't.

Source: I am Chief Medical Officer of a health system.

Edit: grammar

Edit 2: spelling

Edit 3: I should clarify how our process works internally. The audit starts with a collection of information from the system itself. This information is reviewed by the manager of that employee to determine if the access was appropriate or not. If they do not feel it was appropriate, then the manager would conduct an investigation. If the outcome of this investigation (including an interview of the employee) was that the record was accessed inappropriately (not accidentally), then the zero tolerance policy comes into effect. Having done this type of investigation several times myself, it is fairly apparent which breaches are the real deal.

Edit 4: I generally do not like zero tolerance policies. They can be abused and can result in casualties (as some commenters have suggested. However, an intentional data breach for something as sensitive as personal medical information raises a level of risk and mistrust that cannot be surmounted. Should an employee breach a record purposefully, there is no other appropriate recourse other than termination.