That was my reaction a few weeks ago when an email from a medical professional was misdirected to me instead of its intended recipient, with more than enough detail to pin down the exact person it was meant for. Oops. That's bad, right? But it didn't really betray much about the patient's condition, just a "Hi, we'll need to reschedule your surgery because our operating suites are having problems." I was concerned that information about a patient was being communicated to me by accident, but I just shrugged, said, "It happens," and sent an email to them saying, "This did not go to the correct address. I'm not sure where it was meant to go."
I never got a response, but I assumed records had been updated.
Until today. When I got a second email from the exact same person, giving me details of time and place and procedure and other information about the patient's medical condition.
I replied again, CCing the patient this time, since the correct email address was actually right there in the text of the message being replied to. No response as of posting time.
Seriously, how cavalier can you be about protected medical information? Come on!