[baddox]

It's pretty easy to establish the malware attackers' responsibility. But the extent of the hospital's responsibility is much harder to establish, especially across all types of potential attacks. Basically, it's not easy to establish precisely which types of attacks a hospital needs to be prepared for in order for them to not be considered negligent.

In this case, I don't see many details, but it does sound like they simply couldn't access patient data and thus were transferring patients. I find it hard to believe that they couldn't have continued to provide emergency treatments that don't require networked computerized machinery.

But I'd want to know more about the attack before I could conclude that the hospital was negligent. Surely for every hospital there is some attack with sufficient sophistication to disrupt service at the hospital.