It's a Major breach of HIPAA..... regardless of whether it is openly available or protected by username/password combo IMO.