I mean, of course? This is why I opposed electronic health record ( EPD (elektronisch patiëntendossier)) back in the days. Even then, SSL (TLS) downgrade attack existed and was known to NSA. IIRC EPD was started as opt-in, then opt-out, then mandatory.

I received my daughter's ASD diagnosis via Zivver. This included very personal details about her life. No parent would want that to be public. For adults it is worse: they become vulnerable to extortion, and Mossad is known to go very far for the cause.