Re: who's responsibility?
Nope. XP Embedded on most of the kit I've seen, but some of the Carl Zeiss Meditec stuff has been upgraded to 7 now. My experience of working in healthcare was that people were more concerned with physical security (make sure no one can get into the room with the expensive equipment) than information security (make sure people can't access the expensive equipment over the network), but I'm sure all trusts varied.