Seems like more of a pessimist's take. I know the company I work at[1], at least has an ingrained culture of security that permeates through the org and dictates software development practices and tech stack. It probably helps to be a startup, where smaller missteps would be a bigger deal than for an established player.

[1] https://www.commure.com/

Well, EMRs are generally part of older, established presences which have inertia. But companies like Apple and Alto are innovating in the medical space, and they're still governed by HIPAA.