I'd make it a crime punishable by prison in proportion to the amount paid, or perhaps require a multiple of the amount paid as a fine. If you need to pay 10X the ransom as a fine, then the ransom criminals can extract goes down by a factor of 10.
No offense, but this proposal is essentially DOA.
As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.
Enforcing a fine relative to the ransom paid (and maybe relative to the "if we wouldn't have paid it" severity) is probably a good immediate start. This would at least galvanize businesses to improve existing security.
Every single thing done by a government, or really just any large player in the market place, is going to have small businesses that get flattened by it. That your entire company could be wiped out by changes in the marketplace, including laws, is one of the risks a person assumes when they decide to start a small business instead of working as an employee. They're earning their slice of the money pie in part by assuming that risk.
But the stories of hospitals and other entities paying non-trivial sums in ransom I would expect are mostly professional criminals, not hackers doing it for lulz.