You would have to lock such machines down such that they have no direct connection to the internet and no way to get data off of them via portable disk storage.

You would have to lock such machines down such that they have no direct connection to the internet and no way to get data off of them via portable disk storage. In practice this is enough of an impediment to getting actual work done that it's unrealistic. You are basically asking companies to create SKIF's. For a defense contractor working in intelligence it is often the case that they work in SKIF's provided by the Government. But in healthcare it's probably unreasonable to expect it.