What bothers me is that I was under the impression that if you have a HIPAA compliant information system (software or hardware) that none of these criticisms would be true, yet we know that this is essentially the norm and that healthcare providers routinely ignore the problem. What&#x27;s going on such that hospitals have the worst of both worlds - expensive devices subject to incredible amounts of regulation to safeguard patients but demonstrably insecure systems? I&#x27;d hate to think of what would happen if we had no regulations whatsoever, but on the other hand the current effective infosec status of the healthcare industry seems to be not very far off from as if they had no regulations.<p>Did I miss something in HIPAA about &quot;don&#x27;t make it easy as hell for any random person to come in and steal patient data or command other HIPAA compliant systems to act as an agent?&quot;