Is It Legal for a Dr. to Leave Patients Med Records (Including Nude Photos) in an Unsealed Envel. on the Outside of Office Door?

I have seen a plastic surgeon recently who performed an unsuccessful breast augmentation on me. I requested a copy of my medical records. When I arrived at the Dr.'s office during normal business hours, my records were taped in an unsealed envelope to the outside of the office door with my full name written on it. Nude breast photos were inside. The door was locked and lights were off. This was right next to the elevator lobby. Anyone could have taken them. Was it legal to do that?