Optimizing Investments in Cyber Hygiene for Protecting Healthcare Users