I once worked for a HIPAA controlled healthcare company and complained about their security when I found out all the production database and server passwords were stored in a text file available to most of the company. Their defense was "we passed our security audits so it's ok."