The latest example of managers who don't get that computers work by copying data.
Given HIPAA standards I'm suprised they are just asking for a user account. An unknown public server at a medical facility is a definite risk, and IT is probably very aware of HIPAA standards. Then again, they probably don't think twice when installing the latest version of whatever commercial software they use that makes outgoing TCP connections from "license compliance".
If the Phoenicians where as scared as the US public is of making a dangerous voyage they would have been forgotten. We can't make the most complicated machine ever built, built by the lowest bidder as safe as a minivan. Then again, if you consider accident risk per mile, the auto industry has a high standard to match. Nothing ventured, nothing gained.
My medium format doesn't need coal power electricity, but I haven't seen a digital that doesn't need an electrical power.
Have you reconsidered a computer career?