>IT security doesn't really produce any revenue.
Hospitals (and the health care industry at large) has been drowning in billions-with-a-B federal and state dollars since ARRA. All in the name of "meaningful use" of health information technology. HIT is very much a revenue model for hospitals.
http://healthaffairs.org/blog/2015/03/04/where-is-hitechs-35...
https://www.health.ny.gov/technology/efficiency_and_affordab...
http://www.hrsa.gov/ruralhealth/resources/healthit/
http://www.ehrinstitute.org/articles.lib/items/Grants-for-EH...
http://calhipso.org/news-and-updates/more-than-1-2-million-i...
###
* re: operating margins TIME magazine puts margins at an average operating margin of not-for-profit hospitals is 11.7 percent.
According to the AHA Annual Survey, the average operating margin of all hospitals was 5.5 percent in 2011.
So, the industry themselves declare 5.5% margin for non-profit hospitals, a healthy margin for any non-profit entity.