It all depends on the value we assign to privacy. My personal opinion is that the handling of patient data should legally be protected somewhere on a scale betw

It all depends on the value we assign to privacy. My personal opinion is that the handling of patient data should legally be protected somewhere on a scale between banking data and state secrets. If those kinds of data are mishandled, there _is_ punishment, no matter where you work. But then I'm culturally biased (we here in Germany seem to be collectively more paranoid about privacy than most other populations).