Apparently the system was misconfigured. It was part of a HIPAA security evaluation and the business was hideously insecure. Man, I'd love to work for an operation like that!
http://www.darkreading.com/document.asp?doc_id=99347&WT.svl=tease3_2
http://www.darkreading.com/document.asp?doc_id=99347&WT.svl=tease3_2