Cybersecurity for Connected Medical Devices

The threat landscape

Hospitals absorbed a disproportionate share of ransomware incidents through the early 2020s, with the HHS Office for Civil Rights breach portal listing hundreds of covered-entity incidents annually. Connected bedside devices are rarely the initial entry point, but a flat network lets an EHR-server compromise reach the infusion pump.

SBOMs and premarket expectations

Section 524B of the FD&C Act (added by the December 2022 omnibus) requires manufacturers of cyber devices to submit a Software Bill of Materials (SBOM), a plan to monitor and patch vulnerabilities, and reasonable assurance that the device is cybersecure. The FDA 2023 Premarket Cybersecurity Guidance operationalizes this.

Network segmentation

• Biomedical VLANs isolate device traffic from clinical PCs.
• Micro-segmentation limits east-west movement between devices in the same VLAN.
• NAC (Network Access Control) enforces posture at connection.
• Passive discovery (deep packet inspection) is preferred over active scanning, which can crash legacy devices.

Standards and frameworks

• NIST Cybersecurity Framework 2.0 — the reference risk framework.
• HHS 405(d) HICP — Health Industry Cybersecurity Practices, tailored guidance.
• IEC 81001-5-1 — health software security lifecycle.
• ANSI/AAMI SW96 — medical-device security risk management.