Don’t conflate doctor/patient confidentiality and data security. If someone broke into an office and stole medical records, that’s not a violation of doctor/patient confidentiality, even if the doctor chose crappy locks on their doors.