Yeah that’s fair, I do think organizational ineptitude is a concern. I guess it’s just different threat models. A medical office has locking file cabinets, pass

Yeah that’s fair, I do think organizational ineptitude is a concern. I guess it’s just different threat models. A medical office has locking file cabinets, password-protected devices/networks, more robust building security, the standards of hipaa, etc. (granted all of those are subject to proper implementation) If I needed to get one person’s medical information, I think I’d I have a higher likelihood of getting it from their medicine cabinet or snooping on their devices or search history. If I needed the information of many people, I’d target the doctor. But even then, the goal typically isn’t to leak anyone’s information, it’s to get money from the healthcare provider and the information stays secret, theoretically. Not really disagreeing with you just rambling.