IoMT and Medical Device Security
Internet of Medical Things (IoMT) refers to connected medical devices — infusion pumps, MRI machines, patient monitors, ventilators, imaging systems. According to the 2025 Claroty healthcare cybersecurity survey, the average hospital has 10–15 connected medical device types per bed, and many run embedded operating systems that cannot be patched.
Common IoMT security weaknesses:
- Default passwords that are rarely changed
- Unencrypted communications with the EHR
- Outdated embedded operating systems (Windows XP, Windows 7)
- No mechanism for vendor patch deployment
- Inability to install endpoint protection
The FDA's premarket cybersecurity guidance (updated September 2023) now requires manufacturers to provide a Software Bill of Materials (SBOM), disclose vulnerabilities within a defined timeline, and design for patchability. Hospitals should require SBOMs in all new device procurement contracts.
EHR and Clinical System Protection
Electronic Health Record systems are the center of clinical operations — and the most valuable target. Three key defenses:
- Multi-factor authentication on every clinical system access, especially remote access for physicians.
- Role-based access controls with break-glass procedures for emergency access — and audit logging of every access to PHI.
- EHR activity monitoring using tools like Imprivata, Verato, or NextGate to flag anomalous access (massive record downloads, access to VIP records, access from unusual locations).
Healthcare Vendor and Supply Chain Risk
The 2023 Conduent breach (62.2M Americans affected) and the 2024 Change Healthcare attack (192.7M individuals) demonstrate that a single vendor can expose tens of millions of records. Healthcare organizations must:
- Maintain an accurate inventory of every business associate with PHI access.
- Require HIPAA Business Associate Agreements (BAAs) from every vendor handling PHI.
- Conduct annual vendor security reviews for high-risk business associates.
- Include cybersecurity requirements in every procurement contract.
- Monitor vendor security posture continuously, not just at procurement time.
Ransomware Defense for Hospitals
Healthcare ransomware response is uniquely complex because downtime directly threatens patient safety. The American Hospital Association and HHS recommend:
- Daily backups, with at least one copy stored offline and immutable.
- Network segmentation between clinical systems, business systems, and the internet.
- Practice downtime procedures quarterly, including paper-based clinical workflows.
- Pre-negotiated incident response retainers with cybersecurity law firms and forensic vendors.
- CISA-aligned cyber insurance with explicit coverage for ransom payments and recovery costs.
What to Do After a Healthcare Breach
The HIPAA Breach Notification Rule (45 CFR §164.404) requires:
- Notify affected individuals within 60 days of discovery by first-class mail or email.
- Notify HHS OCR within 60 days if 500 or more individuals are affected; annually for smaller breaches.
- Notify prominent media in the affected state or jurisdiction if 500+ individuals are affected in a state.
- Document the breach with a risk assessment that considers the PHI involved, the unauthorized person, whether PHI was actually acquired or viewed, and the extent of risk reduction.
For the framework side of healthcare compliance, see our complete compliance frameworks guide covering HIPAA, SOC 2, PCI DSS, ISO 27001, and NIST CSF. For the broader incident response side — including data breach insurance that funds healthcare response — see our data breach insurance guide. To build the in-house HIPAA and risk management skills healthcare organizations need, explore the TutorsBot Governance, Risk & Compliance course.
Fazlur Rahman
