I work in the behavioral health field as an IT security admin and network with hospitals/health clinics all all the time. The amount of them using XP and 7 in some capacity should scare everyone. The other security admins know it’s an issue, but they just laugh it off.
I tell them if I were an immoral man, their company would be compromised just based off of that information.