In some cases they should, but the chain of responsibility does not end with the technical staff. Technical staff needs resources from management and may own/i

In some cases they should, but the chain of responsibility does not end with the technical staff. Technical staff needs resources from management and may own/inherit a well-organized network or a complete clusterf*ck depending on the organization. Management deploys resources to a level to not annoy owners / investors. This level is influenced by external forces, like regulation. So regulators need to step their game way up, but are also time & resource-constrained. How do regulators pull the needed resources? Tax money. How to justify tax money? Have a public that is informed of the danger and criticality of having hospitals operated in the way they are right now. This is of course a big simplification, but the chain goes much further than just "IT that doesn't patch."