I’ve worked at three healthcare startups so far, and have researched dozens to decide if they were somewhere I wanted to work. My intuition is that healthcare

I’ve worked at three healthcare startups so far, and have researched dozens to decide if they were somewhere I wanted to work. My intuition is that healthcare is a field that is fundamentally at odds with the tech community mantra of “move fast and break things”. Rapid iteration is absolutely necessary to get a company off the ground, and that is not _incompatible_ with healthcare. I’ve found that there is an inflection point in the growth of healthcare companies where they have to rapidly change from “startup” to “mature business” and that seems to be very difficult to manage from a business standpoint. Very broadly speaking - if a company is founded by “tech people”, this point is when their product reaches product/market fit and begins to gain users exponentially. The tech stack is typically pretty solid at this point (common and expected issues with tech debt, etc., excluded), but there often seems to have been insufficient attention paid to the regulatory issues surrounding PHI/PII. This can lead to data breaches like in the OP, but more often I think it leads to a period of slower iteration while engineering retools the product to properly deal with the regulatory concerns. If a company is founded by “healthcare people”, security is _usually_ handled appropriately almost from the very beginning, but this point is reached when the feature set of the product gets too big for the developers to keep stable while implementing new features. This seems to lead to instability and a slow death march for the development team as the performance issues start to pop up more and more often, and new features take longer and longer to implement. Successfully navigating this means bringing on more experienced developers/engineers and a focus on “best practices” - automated testing, a proper CI/CD pipeline, etc.