Doesn't this lead to perverse incentives ? If they had to pay the ransom there would be a price set on security complacency, and that becomes the yardstick to

Doesn't this lead to perverse incentives ? If they had to pay the ransom there would be a price set on security complacency, and that becomes the yardstick to use on further investments to harden their systems. In contrast, losing all patient data is now associated with a malicious attack, so they can hide behind the victim status, the actual damage isn't directly on their bottom line but on the quality of the care to their patient, and they can keep underinvesting in security as long as they have plausible deniability of wrongdoing in the next attack.