I've been the person disabling the accounts of former employees in just that situation after a couple of warnings. Not being an employee or always on-site I have no idea if there were other "dumb and inconsequential" rules also being broken, but I know for sure when the "no personal email or surfing" rule stopped being broken. Admittedly the case I'm thinking of was a low-level staffer not a medical professional (or developer), but on the other hand I've also seen the advice to "find your indispensable person and fire them (before they quit or get hit by a bus)."

I've also been the person being asked "hey, just between us, how can I check my email/MySpace/LiveJournal/Facebook/Flavor-of-the-week?" Answer: Get a smartphone, use their app or check your email during breaks on your phone not on the company network. Some places are more rigid about this and some are less. I also tell businesses that I can do some measure of blocking, but that at its core things like this are a business and HR policy thing as much as they're a technical issue to be addressed.

And finally, I've been the person charging for cleaning up viruses, doing nuke-and-paves, and (fortunately only once) restoring from backup after what I'll still call "stupid user tricks" when a senior partner wanted a newer version of Office and went to download it. Ain't Cryptolocker fun?