Here in NL my local doctors office just delegates their IT to some US-based company. I doubt they take privacy seriously. Their whole security is a joke. but they make a theatre out of it to give an impression otherwise.

EU law means little in this respect, since it's not enforced and most people don't understand enough on the subject to even evaluate what's going on with their data (or their clients data).