[codewright]

I don't think security is a priority for most EHRs that don't have an established procedural culture.

Part of the advantage of being a startup is being able to run around with untenable liabilities and cutting corners the 'big guys' can't cut under pain of tort.