Have you ever heard of defense in depth? You need multiple layers of protection. Plenty of healthcare facilities have been hit with ransomware in recent years. This can happen from opening email or social media attachments, among other things.

Not using Facebook is standard for any profession and will surely get you fired at many companies (like the one I work at). They could use their smartphone on their break for internet.

The sort of security indifference or ignorance the op describes is actually quite common in healthcare. I know someone who works in IT at a hospital and he would tell me about nightmare that it is to have medical staff follow commonsense security protocols (ironic since the medical profession is all about following established protocols).