Shared Health has ‘work to do’ to protect against cyberattacks