> Until recently, the algorithm that was protecting all organ donor patient information in the country, so STI status, mental health, every physical history, was from 1996.

I take issue with the way this point is presented. I'm willing to believe that healthcare data wasn't encrypted with the SOTA methods and one that was regarded as "good enough" instead, but the age of the algorithm has nothing to do with it's security. After all, RSA encryption is from 1977.