They outsourced some IT staff. Reports are that this attack hit the epidemiology department, which lists a 10-person IT staff: https://epibiostat.ucsf.edu/our-team

I don't think we can assume that the IT outsourcing directly affected their vulnerability to this attack.