This is an entirely hypothetical question.
Lets say a clinic has a computer in their waiting room for checking email, surfing the web etc. while patients wait. Lets also assume whoever signed this up wasn't thinking, and this machine is just sitting on an unsecured network for the clinic, and can access patient files stored on other systems.
Lets assume however that all the users of this are well-intentioned, computer illiterate people who click on the Firefox icon and nothing else - they never actually access the patient data, they just could.
Is this, by itself, a HIPAA breach, and if so, how large of a breach is it?