It's a technical problem. Computer is still Magic Box to most people. All they know is marketing. There's a lot of lies around software and it's trivial to get someone, anyone, to upload even very compromising information. Just say you're secure, that you got certification X and businesses A - F use you.

Hell, even tech companies fall for this. They'll upload their shit to some cloud without setting up proper guards because "oh well it's Atlassian". Hope you don't have anything too compromising in that Jira!

Don’t conflate doctor/patient confidentiality and data security. If someone broke into an office and stole medical records, that’s not a violation of doctor/patient confidentiality, even if the doctor chose crappy locks on their doors.