A member looking up a condition is not browsing. The page is what reveals the worry.
No credential stolen, no flaw exploited. Somebody wanted to understand how patients used the portal.