To RAS or not to RAS that is the question.

I have a multiple physcian office that I have inherited from a friend.  I was not there for the initial configuration of the network.  The network consists of a single 2003 Server box with 15 XP Pro clients.  The server is an application server running an EMR application for the office staff.  I was brought in due to a virus issue on the server which came from the Docs remotely accessing the Server, using MS Remote Desktop, and using it as a RAS.  The virus was first found on the server in a folder that belongs to one of the docs.  Needless to say this virus brought down the server and caused a complete work stoppage.  I have told the docs that I think that they should go with a RAS seperate from the application server and they are willing to spend the money for this box.  I would appreciate any information from anyone who has dealt with either a combined application and remote access box or two seperate boxes.  I have my own ideas about what should be done, seperate RA and application servers,  but I would appreciate any other information so I can do what would be best for the docs and their practice.

Thank you very much.