Over a sufficiently long time scale, every organization will eventually have a disgruntled employee who intentionally tries to sabotage their systems out of spite or revenge or even as part of a criminal embezzlement scheme. Competent IT managers need to recognize and guard against that threat. Smaller hospitals may not have the scale or financial resources to hire such people so the only practical solution is to outsource their entire IT infrastructure to a larger vendor that can bring in the necessary competencies. It's sad that the situation has reached this point but we have to face the reality that IT security threats will only continue getting worse.