> It sounds like one of those scummy companies that sells cheap "office solutions" to small companies (in this case doctors offices) that don't have the resources to do things right and in-house.

It doesn't take a large company to not mine data that you're supposed to safe-keep. The problem there is not the lack of internal overseeing, but that they departed from their original administrative business, and went into advertising because "profit".