My OB/GYN has an all electronic office. I had a long talk with him about his data security practices since I am an Information Security Manager, and what he didn't say was he was sending my records to either the insurance company or the government. He sends the billing company a medical description code of the service he performed for billing. He is going to email me tomorrow so I will ask him if he's sharing my info with uncle sam.
Most offices have the patient files in unlocked cabinets. The records are no more secure than a rock and a window.