@Out There: I thought about that, too. I am actually learning that, when working with this therapist, whenever something major just came up and is raw, it's best not to show up for therapy. When she had a premature grandchild and had to move out of state, I vented in session and she lost her professional stance and gave responses that was personal rather than professional. And now this, too. You could be right. She was probably shocked and feeling so uncomfortable.

@Salmon77: But a therapist should be able to separate or categorize issues, right? Just because there may be tension in other areas doesn't mean you can't still have basic courtesy and say "thanks." There are definitely issues in our therapy work. But the session started out fine. No hostility until this point.

I can see how it could be protocol for her to report it to the cyber security folks at the hospital.

But, @ArtleyWilkins: I don't think it's a minor omission. I had said to her that stumbling upon this made me feel very, very uncomfortable, exposed, and naked and I wanted to hide and not come into therapy. Despite this feeling, I still shared this with her and showed up for therapy. When someone brings such a HIPAA violation to your attention, I think it's huge and basic courtesy would be good. I said, "You're welcome" to her to try and bring a close to that topic and move on to something else.