You must not have gotten the memo: Google exposed some of their corporate systems to everyone, therefore VPNs are now useless and have always been useless.
Agreed. Trusting VPNs to be totally secure, especially on a big organization like a hospital, seems insane. At the surgery level, you want to make sure the malware infected laptop or some open wireless access point doesn't come up with more creative surgeries.