It feels like the places where security is of utmost importance like in banking, security cards or health are the worst at doing it.

At least, lack of security of credit cards is understandable as banks are profiting from fraud by charging the victim a fee.

In health? This must stop. It's a failure of regulatory bodies as they throw so much junk policies around that the things that really require attention is just overlooked. The overabundance of paperwork and policies is not improving security, it's keeping away actors that could do way better.