Private healthcare is much worse, seemingly they have an open access policy. New breaches occur in the order of millions per week. Not remotely newsworthy anymore. (last time this was mainstream worthy was 200M leaked records in 2024). Last week https://www.securityweek.com/4-1-million-impacted-by-adapthe... Week before that https://www.yahoo.com/news/us/articles/more-9-5-million-pati... 2 weeks before that: https://www.msn.com/en-us/health/general/carecloud-confirms-...
In my experience, any industry following a security standard halts all effort at security once they're compliant with the standard. HIPAA sets a minimum but seems to also guarantee you will get exactly that minimum and nothing better.
And it will remain this was as long as the consequences of not protecting our data remain trivial.