Health bosses are "urgently" investigating how to stop workers looking at patient data without proper reason after 40 staff accessed the records of a boy injured by a crocodile.