Exactly. Nothing justifies risking patient data.

That’s unlikely. Windows PCs can be locked down to stop users installing/upgrading, whilst still allowing them to use software. Just sounds like your radiology department has an inadequate approach to protecting patient data!

No, that’s no excuse. This is patient data we’re talking about here. Like in the UK, I’m sure there’s strict regulation around this kind of thing. If your system isn’t compliant then you upgrade. If you can’t upgrade, then you go paper-based until you find a solution.