That's why I never placed blame on IT. This is a management problem, not an IT problem, front line staff do as they've told. It is management's responsibility

That's why I never placed blame on IT. This is a management problem, not an IT problem, front line staff do as they've told. It is management's responsibility to assess the risks and to decide where money should be spent (in this case on patient critical infrastructure). To use another poster's example: It is like them failing to upkeep their sprinkler system and part of the hospital burning down.