&gt; Yes, at least in medical settings, I think it&#x27;s just as much about accountability and CYA than actually improving overall real-world security.<p>I don&#x27;t think your wrong, but an awful lot of system admins have ended up dealing with lawyers and courts.  Your system admin having had a prior talk with the lawyers about security, HIPA, and who is liable will do wonders for their willingness to bend the rules for you.