At least they have their own on-site security that’s experienced in taking people down.
I continue to believe the real threats are actual insiders and remote attacks.
Dunno how far someone will get with a USB key versus sending everyone a plausible email.
We had one user who called after filling in every email address she had into a very plausible looking O365 login page. She admitted she initially distrusted the email/link that led her to this page and had replied saying so. The hackers on the other end told her to go ahead and do so. I mean, who she to question when it's coming directly from the hospital's lawyer?
Insiders still can be threats. There was a machine that was deployed in a hospital for clinical imaging that some rad tech who guessed the administrator password put folding@home on without telling anyone which crippled that machine's ability to perform its function.
How incredibly bizarre to do something that dumb for no personal benefit.
I do remember an IT admin day that said he ran SETI@Home at a low priority on all machines because detect any problems with a machine (e.g. spyware, crashing, heat problems, etc.)
But 2002 thinking wouldn’t fly in 2019.
The physical security layer at alot of hospitals is almost entirely absent, sadly.
With the main apps being virtualized, workstations are refreshed less often than they used to be.