If it were 'in the cloud', now the hacker has to interface with the time management / payroll service as if it were a web browser client trying to access it, as

If it were 'in the cloud', now the hacker has to interface with the time management / payroll service as if it were a web browser client trying to access it, assuming the network entry was via the hospital itself or some unsecure medical device physically present in the hospital. In absence of a properly-segmented LAN, it's better to have a segmented-by-design WAN in the form of SaaS and cloud vendor-based solutions.