Hospitals bought into a contract where the terms basically said "don't rely on us for anything important, especially not anything that impacts human life". Patients were certainly medically impacted, perhaps up to the point of early death.
Whose incompetence is that? If a hospital pays for an energy redundancy solution where the vendor basically communicates "please don't use us for anything important", and then a power outage costs lives, are we seriously saying that the hospital shouldn't have to pay big time?
I'm not saying that CS shouldn't be liable. I'm saying that when consumers are looking for someone to sue, and regulators are looking for someone to punish, those who directly interface with the consumer should be in the direct line of fire. Hospitals in turn should be able to sue CS.
We certainly should not prefer that the blame goes straight to the engineer as then the consumer would basically have nobody to sue. That's a world of even less accountability. Those who are most capable of taking responsibility should take responsibility, and not merely those who are most blameworthy from first principles of local causality.
There could be billions of dollars of damage here. There must be billions in liability as well to balance the economic scales. This is way past the single individual who pulled the trigger.