I work in I.T. for a healthcare company. Ascension is a pretty large one. The bigger a company gets and the faster it grows, the more it takes on a diversity of varying technologies that all need to be managed, migrated, killed off, merged, hardened, etc. It’s a difficult job especially for healthcare. I know that the company I work for is working very hard to keep up with things, but it’s a logistical nightmare. You MUST have very smart people in charge that have the right priorities. You have to have information channels open to make sure administration knows what the potential issues are. Compartmentalization of information and access. There are so many potential points of failure it’s insane. And then there’s the most important thing of all: making sure all employees are educated enough that they don’t let their credentials get compromised.
Things are getting worse in general because of how hard it is to stay on top of everything nowadays. I just recently got a couple of letters in the mail about my info being leaked by some companies that had my info. I just have to do my part to stay on top of my own responsibilities, watch my own identity and finances, and make sure those around me are being secure, as well. Everybody needs to know how important this is, and many do, but I don’t think enough people really understand or make it a priority.
HHS is instituting new rules for healthcare (and other industries) to help track and respond to these things. The government is getting very involved with this now. I hope it helps.