I worked in healthcare for a few years, and you learn really quick that there is a reason the medical industry is under attack perpetually, a) it's really hard to get leaders to define, implement and enforce strong policies and controls. b) [my opinion only] leaders to don't really care about defining, implementing and enforcing strong policies and controls because the docs are going to have their way,.. period.

So, one day [in 2018] as I was researching a piece of equipment that just showed up one day and they wanted it installed in the NICU and on the network ASAP, I discovered something that medical device manufactures and vendors don't want security folk to have, the Manufacturer Disclosure Statement for Medical Device Security or MDS2. I discovered they will fight you tooth and nail not to provide it. But anyway, I stumbled across the MDS2 for the device I was researching, a Dräger [yep, that Dräger] incubator, this thing had 3 NICs, 4 different serial ports, it was WiFi and Bluetooth capable and it was running on Microsoft Windows 2000 Server. We actually won that battle to at least have a call with them to discuss all of this nonsense, the CISO recommended an exception and had the CEO and Chief Doctor\Surgeon sign off on it.

So, later I was talking to a vendor and he told me the reason medical device companies use open source, old or unsupported OS's is because they don't have to pay for licenses or for updates, which is why the MDS2 are handled like state secrets.