Private Notes are set up to allow All Users to view by default. This will inevitably cause a Private Note to be accidentally visible to users when a writer forgets to change the setting.

The default for Private Notes should be all checkboxes cleared (none selected). This makes the Private Note invisible to all, except the authors in the Portal. There won't be any risk of users seeing a note they're not supposed to see.