The absence of accessed patient records does not make the OpenAI agent intrusion a minor incident