I think there are two components to this:<p>First, HIPAA requirements are in part IT requirements. Every single hospital works really hard to comply with these, because there are huge fines if they don&#x27;t. Some of the problems with hospital IT security might be due to defects in the already quite onerous HIPAA specification.<p>The second is that hospitals are extremely low-margin institutions. Most hospitals (even the really big ones) just break even, especially if they&#x27;re teaching hospitals or serve poorer areas. IT security doesn&#x27;t really produce any revenue.<p>I agree it&#x27;s a problem. This needs a systemic solution–who would pay for IT fixes? Reimbursement is declining and government payment sucks. Most hospitals are in crisis mode as it is.