In my research for my masters degree we found that the security of ehr systems was terrible (systems had Xss, SQL injection...pretty much the SANS top 25 most d

In my research for my masters degree we found that the security of ehr systems was terrible (systems had Xss, SQL injection...pretty much the SANS top 25 most dangerous errors). In talking with a very large vendor (about 2 years ago now) we found that they were just starting to think about security issues, but were years behind best practices. (For more info http://andrew-austin.com/publications http://andrew-austin.com/publications). With the push towards health information exchanges and interoperability, I imagine systems are indeed wide open, not just to government agencies, but also random people walking hrough your hospital.