IoT Medical Device Security: Guarding Your Health

Patient Data Is a Target 

One of the top global targets and threats for health care IoT is patient data, including electronic health records.   

Patient health data is now shared electronically with: 

• Health care providers 
• Insurance companies 
• Pharmacies 
• Medical laboratories and imaging centers 
• Public health agencies 
• Third-party health apps 
• Occupational health and wellness programs 

COVID-19 highlighted the importance of cybersecurity in the health care sector. During the pandemic, cyberattacks surged globally. Health care and banking were the sectors most at risk. Cybercriminals used a wide range of attacks, including: 

• Ransomware 
• Phishing 
• Distributed denial of service (DDoS) 
• Malware 

In 2024, ransomware group ALPHV Black Cat targeted data processing firm Change Healthcare, owned by UnitedHealth Group. Change Healthcare was the largest health care clearinghouse when it suffered the second-largest health data breach of that year.  

Change Healthcare contracts with a broad range of health insurers and providers to facilitate: 

• Payment processing 
• Prior authorizations 
• Insurance verification 
• E-prescribing 

The attack severely disrupted the U.S. operations of hundreds of thousands of: 

• Physician practices 
• Hospitals 
• Pharmacies  

Ascension Health was hit with a cyberattack three months after the attack on Change Healthcare. Cybercriminals stole data from over five and a half million patient records. Their electronic medical record system was offline for a month. 

These attacks demonstrate the “blast radius” effect, where harm spreads far beyond the initial target. The consequences can be severe and often continue for weeks. 

Emergency rooms may be forced to turn away trauma patients. Critical care systems might shut down. Medical devices and scanners could stop operating.  

Patient data and IoT medical devices used for monitoring and treatments must have security. The risk of cyberattacks increases as more medical devices connect to the internet and health care systems. 

Security Vulnerabilities for IoT Medical Devices 

Major security organizations have highlighted increasing cyberthreats. At the 2024 ISC2 Security Congress, experts emphasized the growing threat of nation-state-sponsored cyberattacks. The HIPAA Journal’s H1, 2024 report revealed 387 health care data breaches in the first half of 2024. Each involved 500 or more records — an 8.4% increase from 2023. 

Rapid adoption of connected medical devices has outpaced cybersecurity protections. Hospitals are vulnerable to: 

• Ransomware 
• Data theft 
• Device manipulation 

Medical device hardware and software have long life cycles. Software becomes outdated and loses support for security updates. Not updating the device creates opportunities for bad actors to exploit weaknesses. 

Many medical devices prioritize functionality and patient care, not cybersecurity. They may lack strong protections against hacking or unauthorized access, increasing their attack surface.  

As medical devices become more software-driven and interconnected, they become more vulnerable. While manufacturers work to enhance cybersecurity strategies, hackers continue to develop sophisticated tactics to target these devices. 

Eliminating threats is not possible. However, they can be managed. There must be legal regulations for medical device manufacturers and other organizations in the supply chain.  

Emerging Medical Device Standards and Regulations 

Medical device regulations and certifications vary across countries, determined by factors like: 

• Classification 
• Data flow 
• Data residency requirements 

Devices that manage patient data or operate across borders often face stricter compliance standards. As more data-centric medical devices connect to the internet, authorities adopt new cybersecurity standards and regulations. 

Zero Trust and Security by Design 

As patient health data becomes increasingly connected, the importance of zero trust and security by design grows. It takes an end-to-end approach to secure medical IoT devices, patient data and network infrastructure from internal and external threats. 

Zero Trust 

Zero trust is the concept that no device or user — whether inside or outside the network — should be automatically trusted. Ongoing verification and identity management grant the minimum access level required to perform tasks. 

Security by Design 

With security by design, security must be built into each stage of the connected medical device’s development and manufacturing process to manage and mitigate risks.  

Encryption begins at the device level, encompassing both hardware and software. This protects the data at rest and in transit.  

Security then extends to network connectivity and data transmission. Communication between devices, apps and cloud systems must be safeguarded.  

Comprehensive data visibility across the organization enables efficient monitoring of data. How the data flows and who has accessed it is tracked.   

Meeting Medical Device Regulatory Requirements: Challenges and Solutions 

Medical device manufacturers face several hurdles to meet evolving cybersecurity regulations. Obstacles include: 

• Resource limitations  
• Unclear or changing federal guidance  
• Integrating security practices into existing development  

Organizations can opt to collaborate with a partner for assistance with compliance requirements, such as:   

• Guidance on regulations 
• Support with technical documentation 
• Recommendations for security integration 

The right partner efficiently handles requirements while ensuring smooth product development. 

Telit Cinterion and End-to-End IoT Security 

Build devices with security by design with Telit Cinterion’s:  

• Modules 
• Connectivity plans 
• Platforms  
• Custom solutions  

Our end-to-end strategy minimizes risks and ensures reliable communication.