In 2021, ransomware gangs struck hospitals already overwhelmed by covid-19 pandemic. But Congress and regulatory wheels have ground slowly, mainly promoting best practices that hospitals can choose to ignore. Advertisement Critics say the Change fiasco shows defensive efforts are horribly inadequate. The smallest providers, which may not have any security staff, should get help.