Everyone blaming the hospital for mismanaged IT is missing a couple things:

1) Hospitals are usually swiss cheese in terms of vulnerabilities because patient safety overrules most security issues. It’s very difficult to patch in time

2) Hospitals tend to have a tricky network and asset profile with security staff potentially inheriting decades of unmapped custom IT

3) Theyre usually underresourced and overworked