My university IT (which also runs a huge hospital network) seems to have no idea how to secure their data. Their solution is to encrypt everything, as if disk encryption and VPNs are enough to prevent data theft. They rolled out a csmpus-wide VPN requirement recently based on a Juniper networks system - the exact same system that led to the Anthem data breach that lost 80 million patient records (because Juniper had a slow patch cycle after Heartbleed). No two-factor auth on the VPN, so any one of 50,000 employees with phished credentials could give an attacker VPN access. Meanwhile all the actual patient databases are old, leaky systems they seem uninterested in upgrading. Sheer lunacy.