Fake mail with infected attachment is still the usual way for ransomware if it isn't an inside job or a weakly protected service account from another compromise

Fake mail with infected attachment is still the usual way for ransomware if it isn't an inside job or a weakly protected service account from another compromised partner. Best defense is working backups with regular snapshots. Patient data would still be exposed and I think the only way to mitigate this is collecting the lowest amount of data possible. Ideally patient data is encrypted in a way that the patient himself would need to provide the password to access the information as just-in-time decryption.