Assuming they live in the US, that is against HIPAA and in my experience it is taken very seriously since what you described is crime punished by a fine of up t

Assuming they live in the US, that is against HIPAA and in my experience it is taken very seriously since what you described is crime punished by a fine of up to $250,000 and up to 10 years in jail.