Sometimes the IT staff simply have their hands tied, and network isolation is the best they can do, at least for medical devices.
Billing and file sharing vendors should on the other hand have active maintenance contracts to prevent exactly this.
Sometimes the IT staff simply have their hands tied, and network isolation is the best they can do, at least for medical devices.
Billing and file sharing vendors should on the other hand have active maintenance contracts to prevent exactly this.
Working in healthcare IT (and I should note this is my personal opinion only), it's actually a little more complicated than that. Healthcare software vendors are generally building their software to meet certain certifications (because the clinics are demanding that), as well as fixing security/patient safety issues, and lastly adding in features the clinics want
The problem comes in that not every clinic cares about the certifications, and the software they have "works fine." So there's no incentive to upgrade to a newer version that has security fixes.
It's important to remember that, with a few exceptions, doctors are not IT, and many clinics are small enough that they outsource their IT. If that IT group doesn't force the clinics to upgrade, the clinic will continue using the version that does what they want, as long as it isn't obviously broken.
Clinics are generally risk-averse, which in many cases is the correct mindset. Unfortunately, that affects their perception of the benefits of updated software.