The combination of data security not being built into the processes and the historical tendency of healthcare organizations to underinvest in digital security mean that this highly sensitive information is both easier to seize and worth more than other types of data.