National cyber director says hospitals under attack have no choice but to pay ransom