Biggest 'risk to critical infrastructure' in hospitals is staffing