If I leave my door unlocked while I'm gone, and you come in and steal my laptop, it's still theft. Yes, I'm an idiot, but you're still a criminal.
That being said, I fully agree with you that the hospitals should bear equal fault - the lack of protections around patient records is criminal, and I'd really like to see those whose records were exposed sue both the hospitals at fault and Meta, or better yet, a criminal case from the FTC and the Department of Health.