You're totally right to be concerned in my view. HIPAA absolutely has plenty to say about maintaining security of records, so not only is this T clueless, but their clinic is probably in violation. If they accept insurance/Medicare/Medicaid reimbursement, they would also be in violation and are risking being shut down.