Here's something I witnessed in the early 90s. I was working maintenance at a large CA hospital.

I had to do some work in a wing that ad been closed some months earlier to get it ready to be re-opened. In an open walk-in closet in one of the rooms, there were several cardboard file boxes. They were tossed on the floor, not sitting neatly on the shelves, and were full of file folders with papers.

I removed a couple of folders and examined the contents to see why they had been left there. They were labeled with patient names (last.first) and contained counseling records of the teenage kids who were admitted in the substance abuse program that formerly occupied the wing!

I called my department director up, and he and I secured the files and delivered them to the medical records director.

This incident proves that, no matter how hard some of us try, a lot of information security problems boil down to people who just don't give a damn.