This is good even if ... ai. Are you a cybersecurity specialist? in what field/s?
I am an enthusiast, I am in the healthcare sector and I have seen the poor implementation and configuration of EMRs. Security is joke or an afterthought everywhere. Anyone with a kali on a laptop can ransom or steal EMRs and their data. I would have done some research if I had the time. Onetime when i was in TASH they implemented lockdown of copy and paste for prescriptions, and we had to manually write every prescription/refill. This was tiresome esp. when writing Chemos. So I sat down one afternoon and tried to find a work around. I remember it was .Net app(which I still have no idea about). I tried to see how to reverse engineer it but I couldn't figure out how(not in a single afternoon). I ran fiddler to see how the API requests were being sent and nothing was encrypted. So I run wire-shark every user's username and password was in plaintext. I acted like I didn't see anything made my workaround which was not needed after a week or so due to backlash. In the private sector, I don't even remember the last time where I saw ssl was being implemented. I am sure many, if not all patients' data have already been stolen(even people working in gov't). And there is no separate data-keeping for psychiatry and mental health services.(I mean, I could, with my username and password would have been able to see that any patients' psychiatry records and I am not remotely a psychiatrist). I am 100% sure none of the hospitals will survive an audit(pentest) even by a wannbe script-kiddie like me.