Hospitals facing the prospect of ransomware attacks like the one that afflicted British hospitals in May can take many concrete steps to better protect themselves, but some of the most important measures — such as a national policy not to pay ransoms — may be tougher to formulate.