A class-action lawsuit filed against the surgeon claims he also did nothing to protect his patients’ data, including their financial information and nude photos of them.