Uh, wtf at your therapist using his personal email for his practice. That strikes me as all wrong for multiple reasons.

Not only do I doubt he has instituted any sort of intensified security measures, but what if his personal emails were subpoenaed for some reason? The same goes for his phone. That exposes protected health information. It's just stupid, really - especially when he could just get a Google Voice number and wouldn't have to get an additional phone. The one I see uses her personal phone as well and I don't think much of it.