A relative of mine works in IT for a non-US hospital. (Avoiding naming it because of backlash potential, both for him and myself.)

When he started there, as bottom level IT support, he had access to everything. Admin passwords, doctor's passwords, he could write prescriptions and put a doctor's name on it. He could order anything and everything, and send it anywhere. He could read your medical files, if you were a patient there at any time. There were no restrictions, only some logging.

The place is only >>this week<< securing the network, because the last security guy quit and a new guy started.

I don't know what it's like in the US, but where he is there should be regular audits and criminal negligence charges for this kind of thing.