Data transfer can happen after data acquisition through another machine that can be connected. If that machine is compromised alternative channels can be found. There is no fundamental reason in how the systems work that before that step anything has to be connected online. Having things online is actually a liability, as evidenced by the mere fact that software like crowdstrike should be installed with kernel access on them. Why instead of going that path, we do not just segregate networks to make them more resilient? The only reason I see is all these -aaS business models. Nothing that really relates to the real needs of people or the healthcare system itself. After the ransomware attacks, instead of reducing attack surface the direction was to actually increase liability and risk by having another point that things can fail. I do not think anybody really learnt from that anything imo.