With the Internet locked out, the only thing left is to train employees never to introduce USB sticks into the system--at the risk of picking up a law suit or loss of employment.
Let's assume that the hospital equipment can't be patched enough or in a timely-enough manner to make it safe enough to use with the Internet. To me it's obvious: don't ever allow connections to the Internet in any way.
We can defeat gravity. The problem is the paperwork involved.