I've done my fair share of dealing with IT in hospitals and the single biggest source of "none compliancy" I came across was based on the ridicules power doctor

I've done my fair share of dealing with IT in hospitals and the single biggest source of "none compliancy" I came across was based on the ridicules power doctors yield. They're still treat like Demi G-ds and can and do demand password-less access since they can not be bothered with anything that is not billable, err, in the patient's best interest. The amount of unpatched crappola, the self bought software, of alternative inbound connectivity and hugely expensive machines from well known vendors without even the slightest form of IT security is mind boggling. Add to that the horrendous state of "digital health" which is in its core based on standards like HL7, makes me 100& sure that what we are seeing now it just the humble beginnings.