HIPAA is a good chunk of the reason medical software and practices are so dysfunctional. Medical practices are some of the last places that use faxes because of it.
Contrast this with any method at all of trying to shove a document over the Internet, which will invariably result in something like a scanned attachment email of a PDF that bloats the mail queue and ends up in legal archives and inboxes forever causing problems.
Yes, we've all dreamed of better ways, but that's just like the XKCD standards comic ( https://xkcd.com/927/ ) and ultimately all solutions will require user training and effort.
Discussions like this make me wonder if as a society we'd be better off not trying to perform the impossible: have OpSec that is flawless and never leaks data that might be misused; but to not allow the misuse to happen.
Medical information misuse touches at least the topics of discrimination, selecting victims of misinformation campaigns, exposing personal issues and preferences (E.G. did someone get an abortion; is a topic ripe for abuse, as are medical histories related to other issues.)
Living in a glass house is far from ideal, but in a world where individual rights are better defined and protected, data security could be more standard.