Money is a factor, but remember, if that budget is not well spent you will get breached. You need policies and governance, risk management, controls and auditing, operational management and contingency. If you don't focus on all 5 you will get breached, no matter how much money you spend. This is something that is more normal on big companies, once you go down the ladder to a small health plan company or a healthcare provider (doctor's office or lab) they don't have the knowledge to realize what is really needed and they are the ones most vulnerable.