This article does a wonderful job shining a light on the void that exists between true security and an understanding of what it takes to be more secure in the healthcare industry. I agree that risk management, a construct fairly familiar to healthcare providers, is a great starting point.

https://www.welivesecurity.com/2017/04/07/healthcare-challenges-ransomware-internet-things-tip-iceberg/