It all depends on which vulnerabilities were exploited for hackers to gain access to backend medical databases.
Seems to be MITM attack, the hackers didn't directly breach the hospital databases, as far as I understand, what they breach is the company that supposed to maintain their computers and networks. And that's why the hackers were able to get accessed to the hospital records and encrypt it.
IT security in the current era tends to be a low priority from a budgeting perspective. There is also a shortage of personnel in the IT security industry.
There are a number of factors which converge to make things like this possible, or perhaps even commonplace. With there not appearing to be much incentive or motivation to address it.
I do agree, in some organizations like hospitals, education and even energy and utilities, they tend not to put a huge budget on their computer/network systems and so they are vulnerable to this kind of exploits and attacks.
And if others could still remember one of the biggest cyber attacks in the last 3 years,
Report: 40% of healthcare organizations hit by WannaCry in past 6 months.
And up to this day, they haven't learn a lesson or two.