I'm usually a bit paranoid about privacy & info being stolen or such from drs or dentist offices..

My dentist doesn't even use a computer for basic things the office.
But many offices don't have much security for the paper files either..
SSI#, birth date, phone, address etc are my main concern..
everything an ID thief would love to have..

My drs website doesn't have notes or personal comments showing, just the basic what the appt was for, treatment any rx, any testing etc.
then the labs & appt time, billing.
You can message them or set up appts..
I think they don't allow the drs confidential comments to be added into the system..if so whoever is typing them up would see those comments also..

As far as site hacking, I suppose it would be a similar risk as an actual office break in.. doesn't seem to happen much.