Here's a simple analogy: You buy a sprinkler system from Acme. Acme cheaps out and installs defective sprinklers. An arson lobs a molotov cocktail through you

Here's a simple analogy: You buy a sprinkler system from Acme. Acme cheaps out and installs defective sprinklers. An arson lobs a molotov cocktail through your window to set your house on fire, but the sprinklers fail and your house burns down as a result. The arson caused the fire, but Acme is simultaneously responsible for the defective sprinklers. The analogy breaks down in the context of the law (as most analogies seem to) because in this case the hospital was not explicitly selling you a product to protect against hackers. However, I think it stands up from a purely ethical point of view.