Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.
It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.
Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.
-ME: I found a problem. The patients get wrong test results in some cases. [explanation]
-IT: No, you don't know how to use the system. [brief instructions for 4y old children, only vaguely related to the issue]
- Look, I did that, it still happens. [attach more instructions to reproduce the problem]
- (1 week later) There could be a problem, but we can't replicate it with your instructions.
- [send video demo]
- Yeah... it could be a small problem, but it's not that serious.
- It's very serious! We send wrong test results to patients! [add more argumentes, examples]
- (1 week later) Yeah... it doesn't seem that serious, it's probably very rare anyway, but here's a workaround [40 clicks procedure]
- I can't do that every time it happens! And it's not rare, it's [x] times a day just the occurences that I know about!
- (1 month no reply)
- Did you read my message? Are you still working on this?
- (1 week later) We sent a support request to [external company]. We're closing this issue until we hear back from them. [closes issue with "invalid"]
- (1 year later, the problem is still there.) Are you still working on this?
- (no reply)
I quit after 7 years and the problem was still there.