Connected-Device Security

Any networked device - infusion pumps, patient monitors with central-station telemetry, imaging modalities - is now a real attack surface, not just a clinical tool. The FDA has formally required cybersecurity documentation as part of premarket submissions for networked devices since 2023, which reflects how seriously this is now treated as a patient-safety issue rather than a purely IT concern.

Baseline practice

• Change default admin credentials on any device that ships with one - this is the single most common real-world finding in medical-device security assessments, and it's entirely within a BMET's ability to fix at commissioning.
• Network segmentation - keep the device on the clinical network segment it was designed for; don't bridge it onto general-purpose IT networks where it becomes reachable from far more potential attack paths than its design ever accounted for.
• Validated patching only - apply manufacturer security patches through their validated update process; an ad-hoc OS patch on a medical device can invalidate its FDA clearance basis, since the device was cleared as tested with a specific software configuration.
• MDS2 tracking - track each networked device against the manufacturer's Manufacturer Disclosure Statement for Medical Device Security (MDS2) form as part of procurement and inventory, so security posture is known before the device ever touches the network.

Legacy equipment

A real, persistent problem: equipment running an operating system the vendor no longer patches (a common example historically has been older imaging workstations on end-of-life Windows versions). These devices can't simply be upgraded without revalidating the entire clinical software stack, so the practical mitigation is usually network isolation and compensating controls rather than an OS update - a decision that belongs to IT security and clinical engineering jointly, not to a single technician in the field.