Over 40 staff members at Palisades Medical Center in North Bergen, N.J. are being investigated, while more than 20 employees have already been suspended for suspicion of leaking George Clooney‘s confidential medical information regarding his motorcycle crash in September.

Clooney and his girlfriend Sarah Larson were involved in a serious motorcycle crash that left Clooney with a fractured rib and Larson with a broken big toe.

According to WCBS, hospital staffers who weren’t even treating Clooney themselves accessed his medical records through the hospital computer system and even one security guard went so far as to give out one of Clooney’s family member’s phone numbers. Leaking medical files is a violation of federal law.

“It was inappropriate but they are paying a steep price,” said Jean Oterson, a union spokeswoman who represents some of the worker. “The apology to him for his privacy rights [is necessary], but I think, in fact, the hospital is overreacting.”

Even though the staffers invaded his privacy, Clooney agrees that they shouldn’t be penalized. “While I very much believe in a patient’s right to privacy, I would hope that this could be settled without suspending medical workers,” he said.