The big problem for them right now (like you say, I would hope the critical/sensitive data is not just scattered across a windows desktop) will be that any affected machines will be out of action.
It seems like there's a dimension to this story that a centralised resource has been affected rather than all local PCs. Some kind of shared patient records system.
For somewhere like the NHS the data shouldn't be stored locally, so dealing with ransomware like that should just be a reinstallation process.
If data is held locally and not backed up, this is going to be a painful lesson.
Of course, IT systems/processes at big companies (and places like the NHS) are woeful.