Information Technology and Cybersecurity
Core concepts
This domain sits where clinical engineering meets IT. Know the CIA triad (confidentiality, integrity, availability) and note that availability usually dominates for clinical devices. Understand network segmentation and VLANs, a maintained inventory of networked devices, and MDS2 forms, which are manufacturer disclosures of security information - not certifications. The standards landscape includes the HIPAA Security Rule for ePHI, the NIST Cybersecurity Framework, and IEC 80001 for risk management of IT networks incorporating medical devices, with IEC 81001-5-1 addressing secure device lifecycles. Interface standards you should recognize: HL7 v2 for messaging, FHIR for modern APIs, and DICOM for imaging.
Medical devices are hard to secure because patching requires manufacturer validation. Compensating controls fill the gap: segmentation, access control lists, monitoring, restricted USB ports, and unique credentials.
Traps
- Scanning or penetration-testing medical devices without coordination. This can cause patient harm and clinical outages.
- Assuming FDA clearance implies security.
- Patching clinical devices on the same cadence as IT endpoints.
- Leaving default passwords and shared accounts in place.
- Treating an MDS2 form as a security guarantee.
- Testing changes in production because a test environment is unavailable.
Rule of thumb
Inventory first, then segment. Place medical devices on managed VLANs with documented firewall rules, never test changes in production, and keep a vulnerability and recall response process with defined timelines and owners. Every networked device needs an owner, a patching plan or documented compensating control, and monitoring.