Healthcare management case analysis

You are the Chief Executive Officer [CEO] of a health services organization [HSO]. The HSO has inpatient and outpatient facilities, home healthcare services, and other services that your patient population needs. You also have a world-renowned AIDS treatment center that has been considered by many to be a model for the rest of the country. The HSO has always enjoyed an excellent reputation and your quality of care is known to be excellent.
The HSO has recently been featured in every media vehicle known to every man, woman and child in the United States and beyond. The reason: someone downloaded the names of 4,000 HIV+ patients who had been seen in the HIV clinic and sent the list to newspapers, magazines and the Internet.
The Board of Trustees is furious and wants to fire you. You have been able to convince them that they need to keep you on to fix the HSO's Management Information System [MIS]. Their last words to you were "you had better come back with plans for building a better MIS or you're fired!"
You hire a computer security consultant and she comes into your organization under disguise as a nurse manager to help you determine where the security leak might be. She returns in three days with the following report.
* Nurses log in with their passwords, walk away, leaving the system open and running
* Dr. Jones leaves his password taped to the PC on a piece of paper
* Fax machines and printers are in open rooms without locks
* One password can access the entire database in the hospital including human resources
* There are no programs reminding staff to change their passwords on a regular basis
* When I pretended to forget my password, other nurses gave me their password
* When I requested sensitive patient files, people rarely questioned me.
There is a major problem with the MIS.
What should be done? And, why?