Pretty sure hospitals were treating patients before they had computers, if the diversion is an hour away emergency patients should be seen and paperwork can be sorted out down the line.
As much as the ransomware folk are culpable, so is the hospitals IS team, companies like mine can be a little lax, we do market research, it's not life or death, these should be isolated in groups, physically as much as possible, yes route out to the internet if you have to (such as support mentioned elsewhere can be something enabled/disabled as required) but even internet access doesn't mean they should be able to access the next machine to prevent a cascading failure.
Yes it's complicated, but, that's why hospitals pay so much in IT. You can't take the pay-cheque that comes with responsibility and then shirk it when you fuck up.
Biting the hand that feeds IT
