Hospitals need to be connected. They need to send and receive EMRs from other hospitals. They need to receive security updates for their own software (eg Windows has a Bluetooth vulnerability... someone could hack from inside). Medical providers need to look up information and consult doctors in other areas if a patient is being transferred.
The solution here does not need to be “operate hospitals in digital isolation.”
I'd argue that hospital computers shouldn't even have Bluetooth, but that aside, you can still achieve outgoing communication without allowing incoming communication. Yes, a hacker might break into an office, hold an employee at gun point and gain access to their account and then move laterally, but that's a very different threat model than "somebody ran an exploit scanner on the university's AS and encrypted our servers".
luckylion|5 years ago