I can argue that it's easier to architect an intranet web medical data viewer right now than a typical desktop application accessing an intranet server. Client

I can argue that it's easier to architect an intranet web medical data viewer right now than a typical desktop application accessing an intranet server. Client-server desktop applications typically use custom protocols and custom servers leading to a higher likelihood of security issues. They're harder/slower/trickier to update and administer within a big organization, leading to a higher chance of messing up. Whatever security issues you can think of running it in a browser context, more exist when running it as native code. If you run an intranet web service with the same security precautions as a public web service, which is currently very well explored, there are less things to go wrong.