It might be negligence on either side or not. We don't have the facts. If the data was not properly secured there are still laws in this country about accessing services without authorization.
A government providing health care to citizens has a reasonable need to hold data necessary for service provision.
There is a huge leap from that to Flock level surveillance. Or appliances and web services that capture and monitor all activity. Worst of all companies like OpenAI training models on copyrighted works and profiting from them without compensation or attribution to the detriment of society.