No credential stolen, no flaw exploited. Somebody wanted to understand how patients used the portal.
The browser did nothing wrong. It carried a work password into a personal account, exactly as designed.