I just hope this doesn't result in poorer security between outside networks (including the internet) and medical devices. I'd argue there should be an "air gap" between the two, but I'm probably more paranoid than most.

Certainly it's fine to use NTP, but I'd want to use some kind of GPS-receiver NTP appliances at each site (possibly redundantly).