There are a bunch of problems that connection and automation bring with them, the rise of digital monocultures seems to be one of them.
However, I could see certain professions operating with simplified "air gapped" systems.
Not connected to the Internet at all. It would take some disciplined processes but it would be possible. Updates could be done by qualified tech's to maintain the air gap when updating with a "sneakernet".
Like any non-technical market, they just bought what was pitched, and there's often more gripes than complains.
One example:
When a patient transfers to another dental office, their records need to follow. Before you "had to" fax or snail-mail them. The software/cloud solutions promised streamlined, painless transfers, but those benefits never really materialized due to the amount of HIPA-compliancy issues (the details around this pain point are fuzzy).
The office-manager explaining all of this was (half-jokingly) fantasizing about going back to snail mail.
I'd say the problem is approximately zero to do with HIPAA; we almost never even talk about it in my experience. It's just a lack of standards, and poor implementations of what standards do exist - every once in awhile something will crash because of a weird escape character or something in an HL7 message (though that could be on us no doubt).
I believe last year was the first time that there was a mandated standard to export EHR data and one of the devs was complaining that it didn't even say if units should be imperial or metric.
I'm told the labs are a complete mess and have no federally mandated standards; I know they've written code because doctor X wants to use lab Y. Obviously the big national labs win because you only have to write code for them once and all customers can use them.
It's just another aspect of a broken American healthcare "system" - there's no incentive for anyone to interoperate in the best case, and in the worst case it allows you to create lock-in for your product.
"Privacy" until a disgruntled staffer copies or takes a picture or just takes the pieces of paper and publishes them.
With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent. With paper, you're screwed.
I still remember a few years ago walking on a street in a city in Easter Europe, behind a bank office for a bank which no longer exists. There were dumpsters nearby that were overflowing with garbage, and the wind was carrying some of it around, like sheets of paper with bank loan applications, ID card scans, etc etc etc.
Paper is not easier to secure than digital systems if the people supposed to secure it don't care.
None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe.
I think you are insightful in identifying care as the key principle. My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components.
But it's relatively easy to only have the people that need specific information to have it. Receptionist only has your names and contact information; doctor only has your relevant medical information; etc etc.
With paper, either everything will be together in a big file, or it would be very impractical to manage.
> My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components.
Potentially. Or they'll improvise because they're a small operation and there's trust. Many a small company has been caught with terrible physical or digital security, because nobody cares and at their scale dedicated people to care don't make sense.
Which brings us back to...
> "Privacy" until a disgruntled staffer copies or takes a picture or just takes the pieces of paper and publishes them.
With paper, it's primarily about the trust you place in people.
With digital it is not only the trust you place in people, you add the trust required for the systems you use; not only the ones you select, but the ones they depend on.
Across a range of systems, we are seeing that we haven't yet mastered complexity.
> Many a small company has been caught with terrible physical or digital security, because nobody cares and at their scale dedicated people to care don't make sense.
Which brings me back to those boutique firms... with paper-only you reduce the problems to one that have been well-understood for hundreds of years. Air-gapped systems seem like an attractive option, but even then, you're depending on both the trust you place in the hardware, OS, and package vendors and in the practice of the new field of digital hygiene by the staff. My prediction is that some clientele somewhere - actors, politicians, billionaires - will decide that their private data should be as private as they can possibly make it, and that it will be the old-fashioned way.