It depends --- There was an example in 2020 when a foreign US IT guy working abroad in a developing country went to do a COVID-19 test in a local private elite hospital. Then, when he went home, he was wondering how secure is the hospital client data. He discovered that patient data was not that secure as he easily accessed his own and also other patients' data from his home PC. Then, he called the hospital It department to alarm them about their insecure IT practices and he offered free consulting advice. However, the hospital denied the security issue. The IT guy reported the incident and the hospital's insecure system in media. Afterwards, the hospital prosecuted the patient for hacking and unlawfully accessing their system :)

Source author: Vladimir Nikolov vladimir984@yahoo.com