The details of some 15000 Dutch general practitioners have been available through a vulnerability that was open for the last four to five years. Details include the hashed password...
Even when people say that they will and actually do their best to secure stuff like this -- there is always a non-zero risk that someone will trip up.
It is all cool and all, but this is a train-wreck waiting to happen... What can we do? Legislation? I have yet to see anything moving in that direction...
Love the optimism. Do you know of any group already looking at this?