I think the DAME viewing your Photo is the least of your worries.
Agree. I doubt the CASA MRS system complies with security and privacy requirements for holding sensitive medical information.
As originally implemented, it allowed your employer (if you used a work email address) or your ISP to access your medical records. Some extra controls have been put in place and it's some time since I last used it so I don't know the current status. I would be surprised if there has been an independent audit of the security.