I met Tim Hoffman at the annual ISSA meeting and we were talking about the problem of malware on medical devices. There is a great article about that here.
I pointed out that the devices mostly worked anyway and Tim wisely pointed out that if he is have a heart attack he doesn't want the defibulator to mostly work. So true.
The article jumps straight to the heart of the problem, with an example from Beth Israel Deaconess Medical Center in Boston: "664 pieces of medical equipment are running on older Windows operating systems that manufactures will not modify or allow the hospital to change—even to add antivirus software—because of disagreements over whether modifications could run afoul of U.S. Food and Drug Administration regulatory reviews."