" Change Control..an updated piece of software..on all the devices that have already been built"
Which is of course a PITA.
However this also suggests that you need to batch up such changes and do "block updates." Test them as a batch and roll out the revised image as a complete chunk outside office hours, give that a large part of the NHS is still a 9/5 Mon/Fri operation.
Naturally that implies you get the time and support to allow those tests to get done.
The NHS (probably along with other medical organizations) is between a rock and hard place. It wants rock solid, avionics grade reliable software. OTOH unlike avionics they don't have full control over the code that runs on the estate, a lot of which is closed source
At some point NHS central management, and trust managements, will have to get their head round the idea that stuff changes and freezing software (and the OS it runs on) for a decade or more, is a very stupid idea. Putting penalty clauses in new software to force developers to be browser agnostic for example would be a start.