None of this surprises me one bit. I have worked in the health space for several years, and I have personally seen the inner workings of several insurers and the manmade horrors within.
It blows my mind that these multibillion dollar institutions are so poorly managed on the technology/IT front. I think most people will have their health data likely leaked at some point.