(not an expert in this field obviously) I believe that it might have to do with HIPAA compliance and the red tape overhead that scares away potential disruption. But I imagine if someone were willing and able to disrupt it, they'd make money hand over fist.