I work in the space, and can say for certain that while everyone talk a good game about their encryption, and compliance policies, the reality is often a bit different.
The whole ordeal was a fairly stressful thing to deal with right after having major surgery. I looked into my legal options after I cleared things up, but I couldn't get anyone to seriously listen to my case. I wanted to know whether the hospital was responsible, but I guess I didn't know who to contact (the right lawyer, etc). Everyone I contacted either weren't able to help me or didn't know I should contact.
Additionally a lot of hospitals have too few, poorly paid and trained IT staff running their in house infrastructure. This is a big mistake, but they think doing it this way is more secure.
And, as you suggest, there are some bad actors. Fortunately there's been a lot of consolidation on the EHR side that's wiped out a lot of the fly by night operations. Third party contractors, are of course another story and a mixed bag.