The real issue with this is the hospital itself funding the hacker. This way, more hackers get encourage of doing the same (with the expectation of getting what they want). Wrong move IMO and they should have tried to find the hacker instead but now his gone but there's no assurance that he won't do it again in some time soon...