A total of 48 NHS trusts were hit by Friday's cyber-attack, of which all but six are now back to normal, Home Secretary Amber Rudd has said.
Speaking after an emergency Cobra meeting, Ms Rudd said "there's always more" that could be done to protect against computer viruses.
She said 97% of NHS trusts were "working as normal" and there was no evidence patient data was affected.
The ransomware attack hit organisations in at least 99 countries.
Europol described it as "unprecedented".
She insisted the government had "the right plans" to limit the impact of the attack, which also targeted the Nissan car plant in Sunderland.
Five NHS trusts are still said to be "needing help" with restoring their IT, including St Bartholomew's in London, the BBC's health editor Hugh Pym said.
He said the 48 NHS trusts affected did not include GP practices and the Scottish health boards.
- Blogger who halted ransomware 'hasn't slept a wink'
- What is the global ransomware outbreak?
- Cyber-attack 'unprecedented' in scale
- Analysis: How it started
The malware spread quickly on Friday leaving hospitals and GPs unable to access patient data, with many doctors resorting to using pen and paper.
Their computers were locked by a ransomware program which demanded a payment to access blocked files.
Hospitals across the UK were cancelling operations and ambulances had been diverted from hospitals in some areas.
The Liberal Democrats and Labour have both demanded an inquiry into the cyber-attack.
Lib Dem home affairs spokesman Lord Paddick said "it has left Britain defenceless". Labour's Jonathan Ashworth also called for a "full, independent inquiry" into the cyber-attack.