Replace the device? Patch the software? Lawmakers want to know how to protect legacy medical equipment from cyberthreats.