Basically yeah. Medical doctors will not do some thing for fear of losing their license to practice. One could argue storing data like this in plain text is malpractice.