It’s been a few months since the worldwide WannaCry ransomware attacks, and a month and a half since the NotPetya attacks that hit U.S. hospitals and the drug company Merck. The cyberattacks were bad enough to get the attention of the health care industry — and the rest of us — but not bad enough to force the industry to solve the underlying problems.