Quick answer: Medical device cyber security protects connected devices such as infusion pumps, imaging systems and patient monitors from attacks that could affect patient safety or data. In the US, manufacturers of “cyber devices” must include cybersecurity information in FDA premarket submissions, including a software bill of materials and a plan to address vulnerabilities. Hospitals protect devices through inventory, network segmentation and monitoring.
Hospitals run thousands of connected devices, many on older operating systems that are hard to patch. Attacks on hospital networks can take devices offline or delay care. This guide explains the risks, the regulatory requirements and practical steps for manufacturers and healthcare providers.
Risks and defenses
| Risk | Example | Defense |
|---|---|---|
| Unpatched legacy software | Devices running unsupported operating systems | Segmentation and compensating controls |
| Ransomware on hospital networks | Imaging or lab systems taken offline | Network isolation, backups, incident plans |
| Default or hard-coded credentials | Remote access using known passwords | Secure design, credential management |
| Insecure communications | Unencrypted data between device and server | Encryption and authentication |
| Third-party components | Vulnerable open-source libraries | SBOMs and vulnerability monitoring |
Because devices stay in service for many years, security has to be designed in and maintained across the whole lifecycle. That is the reason regulators now ask for it at the premarket stage.
FDA requirements for manufacturers
Under section 524B of the Federal Food, Drug, and Cosmetic Act, manufacturers of cyber devices must provide a plan to monitor and address post-market vulnerabilities, processes to provide reasonable assurance the device is secure, and a software bill of materials. FDA explains its expectations on its medical device cybersecurity page. Our guide to the best SBOM generators covers the tooling.
Best practices for hospitals
- Inventory every device, including model, software version and network connections.
- Segment devices from general networks; see network segmentation vs microsegmentation.
- Include security in procurement, asking for SBOMs, patch support periods and disclosure policies.
- Monitor device traffic for unusual behavior.
- Use compensating controls where devices cannot be patched; see compensating controls.
- Plan for downtime with clinical workflows that work without the device.
Related reading: ransomware targeting medical IoT devices and zero trust architecture for IoT. Health organizations can also use the HHS healthcare cybersecurity performance goals.
Frequently asked questions
Why is medical device cyber security important?
Compromised devices can disrupt care, harm patients or expose health data, so security is part of patient safety.
What is a cyber device under FDA rules?
Broadly, a device that includes software, can connect to the internet and could be vulnerable to cybersecurity threats.
Why are medical devices hard to patch?
Updates may need manufacturer validation, and devices are often in constant clinical use, so patching must be carefully scheduled.
What is an SBOM?
A software bill of materials lists the components in a product’s software, helping identify which devices are affected by new vulnerabilities.
Conclusion
Medical device security is shared work. Manufacturers must design and support secure devices, and hospitals must inventory, segment and monitor them. Treat device security as patient safety, and plan clinical workflows that survive an outage.
