Where to start?! I work with several small doctor offices with the same type of equipment setups. If they are willing to spend the money here is what I would suggest.
First, I would upgrade the DSL speeds. I use Yahoo SBC DSL in TX, and for less than $50/month I can get the Pro version which features 1.5mbps download and 384 upload.
Second, upgrade the router. Since they want remote access you would need one that supported VPN connections. Router should also have a firewall included. These types of routers will probably run a couple hundred bucks or better. I found a Netgear for about a $100 that supports 5 vpn connections, with NAT, DoS, ect.
PC’s at least need to be upgraded to something newer. Dell has pretty good deals that are hard to beat, especially when you add 3 year service. Check into business lease.
Server I wouldnt worry about since it is used as a file/print server. A new server would be wasted for that.
I would also run either a third party or WinXP personal firewall on the pc’s. For antivirus, there are plenty of choices out there. For Spyware I personally use the Yahoo anti-spy program and it works pretty good. I am also very careful about where I go and what I download from the internet.
I believe this would be a good start for you. Small offices usually try to upgrade as few times as possible, so you want to do it right and get the best bang for your money.