>> ..which will in turn only cause "security contsultants" to line their pockets further and justify the miserable busybodies..
You obviously don't understand how utterly appalling the security of a lot of software is. My job title is "security consultant" and the last test I did was on a medical related application that tracks medication administered to patients in care facilities. All the sensitive patient data can be read and updated completely unauthenticated. They implemented ALL of their permission checks in the thick client which simply talked to a webservice - anyone with a decompiler and half a brain could alter patients drug doses with no record. This is a large application used in a large number of places.
Maybe we need more security consultants in the medical industry.
There's a lot of really weird systems design that goes on in hospitals, but that doesn't necessarily mean that it is wrong.
The main problem I see is that the security is going to focus on things which won't matter, at the cost of creating still more barriers to entry for new techniques (I may or may not be fighting this battle at my current company).
If your data can be reached by everyone, completely unsecured, that's not a weird design. That is just plain wrong. Security does matter for these things, because human lives and identities are at stake. Health data is far more important than your facebook profile, but it's woefully undersecured. If fixing security problems is "creating more barriers", then so be it, it has to be done.
It's not available to everyone--for example, a lot of institutions don't have wireless (lol) and have pretty strict controls on devices that plug into the wired networks.
what if I break in to the network through a web server? or happen to find an open network port in my hospital room?
Security is done in layers. Physical access is 1 layer, network security is another, requiring proper authentication/authorization for your software is yet another, etc. Each layer stops a percentage of hackers. If you skip important layers like auth, you're allowing a larger number of people in, simple as that.
It's the equivalent of saying "but ofcourse I leave a large pile of cash in the middle of my dining room, my front door is locked, that's secure, right? Putting it in a safe or even a locked closet is just a burden." It ignores basic security principles.
You obviously don't understand how utterly appalling the security of a lot of software is. My job title is "security consultant" and the last test I did was on a medical related application that tracks medication administered to patients in care facilities. All the sensitive patient data can be read and updated completely unauthenticated. They implemented ALL of their permission checks in the thick client which simply talked to a webservice - anyone with a decompiler and half a brain could alter patients drug doses with no record. This is a large application used in a large number of places.
Maybe we need more security consultants in the medical industry.