They are institutionally allergic to agile, iterative improvement. It sounds too scary. They want big-design-up-front, even though that's guaranteed to deliver unusable software that's far more dangerous to patients than any transient bug.
Some of this is regulatory, but most is cultural.
It is actually a serious problem.
You have a bunch of apparently sensible rules with apparently reasonable justifications, but without a holistic understanding of what those rules cost in terms of engineering and design trade-offs. Then compliance prohibits the use of commodity components not designed with those specific requirements in mind, which requires everything to be custom for the industry at extreme cost, which in turn impairs competition and allows the vendors who do pay all the compliance lawyers to sell low quality software for big money.
And it's not clear how open source or cloud would solve any of that, other than possibly through some kind of regulatory avoidance shell game, which sounds more like a loophole than a solution.
Think Git/Hg vs CVS when it comes to branching.
IT as currently and usually practised, especially in a healthcare environment, is also mostly a disaster in terms of value for expenditure. $2 billion for an Epic system in a regional hospital system... Which was obsolete before it was installed. Heck, the Deustche Bank SAP core banking replacement only cost $1 billion.
Much of the "oh but it's regulated" excuses are just that, excuses to be ignorant and stay stuck in the 1970s.
It doesn't have to be this way, but it requires a lucky administration to find a way out of the mess given the market for lemons in IT management and systems integrators in healthcare.
Open source and Cloud solutions (from an operating model perspective way more than technology) appear to be the only way out of this mess of "your mess for less" IT because it lifts the veil of sales, consultant-speak, and opaque RFP processes in favor of actually-working-and-reliable software that anyone can see and touch.