I said that perhaps their IT people will opt for securing the network and not applying the patch, but to myself I wondered if that opens them to liability claims or regulatory problems.

Worse: right now, medical facilities are the big target for ransomeware. So I don't think anybody in HIT feels that perimeter security is adequate.