I dug out my login to comment on this:

>There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best.

I worked as a developer for healthcare/hospital websites and the company I worked for took it far more seriously than the hospitals did. We had to babysit them constantly on potential violations and actual violations. The average hospital has at least a dozen different HIPAA violations each and every day because in the end convenience almost always trumps security when a person is stressed and busy. And those were just the violations I was privy to as their web developer - undoubtingly there were even more that I couldn't have been aware of.

When we dropped support for IE8-10 it was a major issue at nearly every hospital we worked with and we couldn't convince them to finally upgrade until lawsuits started happening.

https://www.hipaajournal.com/upgrade-internet-explorer-to-re...

HIPAA compliance is a checkbox and actual security doesn't mean anything because actual security is too inconvenient.