I believe it is. And if a nation were found to be attacking or knowingly permitting the attack of American hospitals in the midst of a pandemic, a physical strike against their military assets (though not personnel) would be proportional.
But this has to be made clear ex ante, which it hasn’t been.
What if that other country has nuclear weapons? Would WWIII start with cyber attacks first?
This is a solved problem. Nuclear powers routinely skirmish, usually through proxies.
Other non-violent but serious responses include closing consulates, enacting sanctions and increasing military deployments close to the enemy’s border.
If the Iranians were behind a cyberattack on hospitals, they may or may not bet a bombing run.
But if the Russians were behind it, there's not telling what would happen.
Probably sanctions and maybe even specific sanctions against specific individuals.
But apparently they know that people are hesitant in retaliating
As I have said before, paying ransoms and not retaliating is a good way to keep being attacked and asked for even more ransoms
There's not that clear balance between "the door was locked and I broke in" and "you were not even trying to secure this", and I would bet that most of these hospitals tilt to the later (MUMPS comes to mind), up to the point you can cause great havoc just by accident. So I would definitely argue against any absolute "everything is a malware attack" classification.
At the very least country doing this should be isolated.