There is the complicating factor that in health, safety can be more important than security: to keep a patient alive in an acute emergency, it is imperative that the doctor can see their data right now, while that fact that third parties can later see the data doesn’t matter too much. The problem is that people tend to use the first aspect as a cheap excuse to do nothing about the second one.