But you're kind of right. Another company would be trying to build this as a web app, but the sensitivity and security required for dealing with healthcare data makes it a no-brainer to build a desktop app.
I'm curious why you think this. Disclaimer I have worked for a cloud based EHR system as well as a HIPAA compliant mobile/web app. We haven't had any issues with sensitivity or security, (obviously following best practices). A password on a physical computer only goes so far, I would venture to say that our systems are *more* secure than a desktop app.
Although, in one case they were happy to use an Enterprise web based solution, but the feeling I got was that there was a year long buy in process that ticked all the boxes before that got approved. Everyone's worries put to rest and such.