If you read Robert Heinlen you know TAANSTAFL –  “There ain’t no such thing as a free lunch”. In the PC world of 2010 we say  stuff like “there is a need for value based decisions in health care”.
Over 20 patients a day die in the UK,from the superbug infections, MRSA and C difficile. It appears you have to spend money on new antibiotics if you want to save lives. The article in the London Times, written by the Vice-Chancellor of the University of Buckingham, Terence Kealey suggests that new research that characterises the key enzymes of MRSA and C difficile, will enable systematic development of new antibiotics for these two superbug infections.  However Dr. Kealey is pessimistic that the bureacratic system of the UK NHS will be able to utilize the innovative drugs because that would cost money.

Although Kealey appears to prefer a more privatized system  of health – looking at trends of data breaches in the United States in the private sector, I would say that gross spending is not the issue. US spending on governance and compliance is over 1% of the US GDP and the US leads the world in privacy breaches and crashed the world economy in Jan 2009 because of lack of corporate governance.
Spending money on threat mitigation is not the issue.  The issue is understanding value at risk (human lives?, customer data?) and spending the money on a cost-effective, prioritized plan with simple, practical methods.
For health – wash your hands, walk instead of driving. For data protection write a one page acceptable usage policy, practice management by example, ethics in the workplace and use data loss prevention monitoring technology.