Networked Medical Devices and Cybersecurity
This domain covers risk management of medical devices on IT networks: shared responsibility between clinical engineering and IT, and the controls that keep therapy available when security fails.
Frameworks and roles
IEC 80001-1 defines the responsible organization (the hospital), the medical device manufacturer and the IT provider, and requires a risk management file for changes to the medical IT network. Since March 2023, FDA premarket review of cyber devices under section 524B of the FD&C Act requires a software bill of materials, a vulnerability monitoring and patching plan, and a coordinated vulnerability disclosure policy; submissions missing these may be refused to accept. The NIST Cybersecurity Framework organizes work into identify, protect, detect, respond and recover.
Hospital controls
Inventory every networked device with operating system, firmware and owner. Segment clinical VLANs, restrict inbound and outbound traffic with access control lists, eliminate shared local administrator accounts, enforce unique credentials and WPA2-Enterprise wireless, monitor for anomalies, and test backup restoration. Patch when the vendor validates a patch; when no patch exists, apply compensating controls with documented risk acceptance.
Worked example
A CT scanner runs an unsupported operating system and the vendor offers no patch for nine months. Place it on a dedicated VLAN with access limited to the PACS, block internet and removable media, add enhanced monitoring, and document residual risk signed by IT and clinical leadership with a 90-day review date.
Traps
- Assuming vendor security equals hospital security.
- Running aggressive vulnerability scans against devices that crash under load.
- Installing unapproved software or operating-system updates that void support.
- Forgetting that availability of therapy outranks perfect patching, but not documentation.