How about this: Medical offices have poor infosec practices. There are many small doctors offices where the doctor is the executive. A vendor will convince th

How about this: Medical offices have poor infosec practices. There are many small doctors offices where the doctor is the executive. A vendor will convince the doctor that their suite of software and hardware will solve all of their problems. The doctor buys the package, and because they believed the vendor, they don't do anything more about security. Then the doctor finds that the package doesn't work with X supplier or whatever, so the doc buys another package from another vendor, but keeps the old stuff. The surface area is large and fertile. So it's not necessarily that EHRs are particularly valuable, but that they are particularly available.