I've worked in medical software and I want to second indymike on this, because I think it is important. The requirements for security or privacy are used as exc

I've worked in medical software and I want to second indymike on this, because I think it is important. The requirements for security or privacy are used as excuses to make only the smallest and most moderate of improvements to these applications. Year after year the UI stays the same and the product stays the same and the pain points for the customer's employees stays the same (remember that doctors in hospitals have some say but the business-side of the organization buy this software). IMHO, this is one of the big excuses they use to push off interoperability. The lack of interoperability combined with the big vendors controlling the standards (i.e. HL7 or whatever) are freezing smaller vendors who might have dramatically better products out of the market. Mark my words, the big consulting firms will use security compliance as another way to keep smaller and more agile companies (some with dramatically better products) out of the market.