The malware group is not asking for donations to organizations, but to individuals at the hospital. They are requiring that someone at the infected business records videos of themselves going to a hospital or health clinic, looking for people who seem like they need financial help and offering to help them pay for their medical care.
1) Good luck suing poor individuals to get your money back
2) It's hard to fathom what kind of asshole you'd have to be to walk into an ER, record a video of you offering people money to help pay their hospital bill and then demand that money back off-camera.
I imagine you'd explain before recording what is going on (assuming you don't just fake the entire thing with some friends), rather than doing anything as silly as suing anybody. It wouldn't take more than a token amount to get people to participate. A lot of people wouldn't even want money. They'd get that this kind of blackmail is horrible and help you out.
1) Good luck suing poor individuals to get your money back 2) It's hard to fathom what kind of asshole you'd have to be to walk into an ER, record a video of you offering people money to help pay their hospital bill and then demand that money back off-camera.