This must be one of those situations that keep you up at night even at the age of 105, the event being 50 years in the past. I am really glad my job has nowhere near that kind of responsibility.
That is horrifying. Windows Server 2003 is 8 years past EOL meaning it hasn’t received any security patches since then. For such a highly regulated industry your entire tech department need’s launched into the sun.
I work in the tech department for a company and I guarantee that they have made management aware and management's response was "No it costs money, so I don't want to. Anyway it's working fine."
It's our job to tell management that they're being idiots, but it really is their responsibility to stop being idiots. If they don't, that's on them, and I have the emails to prove it.