Cyber guy here. I totally agree that protections and consequences need to be heavier, and I'd like to see that extend to organizations that get breached due to negligence and poor practices. The patients are the victims here 100%, but this medical org also has potential culpability based on what they did or didn't do to prevent and contain a breach