Healthcare IT, Cybersecurity, and Interoperability
What this domain tests
This domain tests your ability to manage networked medical devices as part of a clinical system. It covers IEC 80001-1 risk management for IT networks incorporating medical devices, HIPAA Security Rule safeguards, NIST cybersecurity framework concepts, FDA premarket cybersecurity expectations such as threat modeling and software bill of materials (SBOM), and interoperability standards including HL7 v2, FHIR, DICOM, and IHE profiles.
Core rules
- IEC 80001-1: connecting a device to the network creates a medical IT network risk; assign responsibilities among the medical device manufacturer, IT, and clinical engineering, and document the risk assessment.
- HIPAA Security Rule: administrative, physical, and technical safeguards protect electronic protected health information; device logs and images can contain identifiers.
- Cybersecurity lifecycle: inventory and SBOM, vulnerability monitoring, risk-based patching, network segmentation, least privilege, and incident response. Legacy devices may need compensating controls rather than patches.
- Interoperability: HL7 v2 remains common for ADT and orders; FHIR uses RESTful resources; DICOM handles imaging; IHE profiles define integration workflows. Test interfaces with actual messages, not just a successful ping.
Worked example
A department wants to add Wi-Fi to bedside monitors and send vital signs to the EHR. Reasoning: trigger an IEC 80001-1 risk assessment; confirm the monitor's wireless configuration and encryption; segment the device VLAN; validate identity and access management; map data fields to the EHR interface; test alarm and data latency; define patch responsibility with the vendor; document residual risk and a rollback plan. Connectivity is not the same as clinical validation.
Traps that cost marks
- Treating cybersecurity as an IT-only problem.
- Connecting a device because it “supports HL7” without message validation.
- Ignoring legacy devices that cannot be patched.
- Forgetting that DICOM headers can carry protected health information.