Why on earth would you keep naked pics of your clients on a computer connected to the Internet?
I've now debugged (as a well known patient) two computer systems for local clinics - and they were completely and entirely owned from the ground up. They saw this as completely normal/routine (as in - "oh man, call the IT guy - we've been infected again!"), and I watched as they would minimize whatever medical records app they used with my info in it to pull up the toolbar-laden IE to run my credit card via an on-line processor.
Luckily in those cases it was typical malware/botnet infestation. All it takes is the wrong person/group to come across that secretary's workstation that is almost assuredly connected to the same network the random medical equipment and storage is as well.
Security/IT in general in healthcare is a complete unmitigated disaster. Everyone focuses on hospitals (for good reason) - but those are typically far better ran than your local plastic surgery/lasik/clinic practice.
Not too long ago I saw a straight-faced suggestion on this forum that doctors should have cameras in their offices to record all patient interactions/exams/procedures for ML purposes.
I'd be out the door immediately if a doctor ever pulled something like this.
On the other hand, the clinic in question has a big "follow us live in surgery & clinic" banner with Facebook, Twitter, YouTube, Instagram and Snapchat links on their home page...