The security bug is now fixed, but the patient who found it said it was challenging to alert the software company about the issue.