Could internet-facing RDP have caused our ransomware infection?

It could have been RDP, especially if the computer accepted remote desktop connections directly from the internet. Attackers scan for those services and may try stolen passwords or repeated login attempts. But the infection alone doesn't tell you how they got in.

Someone needs to check how remote access was configured and review the available security logs before settling on a cause. Email, websites, and documents are possible routes too, even if people rarely download files deliberately.

For the replacement setup, don't expose RDP directly to the internet. A common option is a VPN, which gives authorized users a protected connection into the institution's network. They connect to the VPN first, then use RDP to reach the computer through that connection.

Require multi-factor authentication for the VPN, keep the VPN and Windows updated, and restrict access to the people who need it. A VPN still needs careful setup and maintenance, so have a qualified IT professional configure and review it rather than treating it as a quick switch.

Deal with the incident before bringing remote access back. Disconnect the affected computer from the network and contact the institution's incident response or IT team. If the first contact isn't helping, escalate to whoever is responsible for IT or management.

Have them preserve relevant logs and investigate other systems and accounts that could be affected. Rebuild the computer from a trusted source and restore from clean backups after those backups have been checked. Credentials used on the affected machine may need to be reset too. Data theft is possible, but ransomware doesn't prove it happened.

For learning, look up the Windows documentation on Remote Desktop security and the documentation for whichever VPN your institution chooses. Start with the difference between a public internet connection and access limited to a private network. That makes the rest much easier to follow.