So there's a lot of regulation and compliance stuff that you run into if you start dealing with computers in a medical context. On the face of it, this makes se

So there's a lot of regulation and compliance stuff that you run into if you start dealing with computers in a medical context. On the face of it, this makes sense; you don't want to install software that hasn't been rigorously tested and approved, because the cost of having a computer fail can be human lives. If you have something that works, it's hard to get the inertia to change it because by the time you've finished testing a new piece of software to make sure it's as stable as you need, it's already out of date. So in one sense, those machines are unupgradable; you can't upgrade them without violating a number of laws and regulations. In another sense, they're trivially upgradable; if you don't care about violating laws and regulations, you've got a playground with a number of highly documented vulnerabilities and publicized exploits. The sorts of people who would install malware on those computers are the sorts of people who aren't really fussed about "laws and regulations"; that's not a position that people running a hospital are really able to take, though.