The UK has the Data Processing Act of 2018 and this would violate that law as well. It's probably stricter because it includes the GDPR by reference.

The HIPAA rules are full of "Observe best practices" and "Take reasonable precautions" terms. This obviously flies in the face of that, but they use weasel terms for a reason.

They'll have a compliance officer, who would note these kinds of things, but honestly, it's not until there's a breach and investigation that anything actually happens. Nobody gets slammed about HIPAA until someone's records are actually visibly seen by someone else. The corporation involved would need to take preventive action against the doctor for being reckless, which honestly never happens anywhere I've been.

Because this made the news, he might get a talking-to and a policy put in place. I'd give it 70:30 because it's a particularly bad look on wherever he was practicing. Now if he was also the compliance officer for the practice, or it was a one-man band, nothing will actually happen.

Most likely they've outsourced their infrastructure anyway...