It's interesting to see how IT is perceived as a cost-center and not essential to the business in healthcare; yet everything crumbles and collapses when there's an IT outage.

These organizations might not be culturally accustomed to have IT at the core of their business/mission, but it very much is. They might not value engineering skills and people in IT, but they have evolved an absolute dependency on those over the years.

The issue here is cultural, not technical. These ransomware attacks, breaches and outages are completely self-imposed. They can end anytime as soon as the hospital wants it. All they have to do is value and acknowledge IT as a fundamental pillar of their organization, comp it appropriately and make sure to run on hardware that's patched and safe to use. Really no different than washing hands before a procedure to stop infections. Else the cycle will endlessly repeat itself.