Both sides are absolutely culpable, but it couldn’t happen if the hoarding weren’t permitted and normalised.
There are legitimate and justifiable reasons to collect and store medical data, but it should be selective, limited, and siloed. Access should be embarrassingly transparent with excessive monitoring and active alerting, and cross referencing should require explicit elevated access.
There should not be a universal ‘Medicare Portal’, especially one accessible from the public internet. Providing and permitting such a tool is catastrophic negligence.