" While we believe that individuals need to be held accountable if they violated patient privacy , we also believe that the hospital had a responsibility to establish proper systems to protect patient privacy , " Twomey said .