Huh - I worked in health with HIPPA data issues as well - never had this hardware specific issue. But, we were a group of software engineers who weren't idiots - so... we understood that bringing our own monitor or keyboard/mouse wasn't likely to do anything and not a real risk.

I have a keyboard that runs custom, open-source software.

It would be easy to figure that out about me, if you cared. Say if you found a list of employees and contractors.

A sufficiently-motivated attacker could backdoor my firmware with a timer-based exploit (e.g., start your keystroke payload after ten minutes without input events) and I might well not notice if it was a deft-enough change.

It might not be worth the cost, given that I might well notice it and it might not pay off even if I didn't.

Still - the point is that keyboards are not innocuous, harmless devices that it's a no-brainer to allow.