Absolutely we need to decrease the attack surface. We can't expect for each of those doctors to make sure they always have the latest version of Windows, etc. I

Absolutely we need to decrease the attack surface. We can't expect for each of those doctors to make sure they always have the latest version of Windows, etc. I'd also go so far as saying that we can't even trust IT to always update the systems because large corporates loose track of boxes all the time.