When hackers target healthcare systems, medical devices can be high-impact casualties. Clinical technology is complex and multifaceted, incorporating online systems with hardware devices. The technology has led to advances in care and diagnostic success, but also increased potential vulnerabilities. When a network is knocked offline, medical devices can also be affected. As cyberattacks against healthcare increase, so does risk to medical devices. One recent survey of healthcare executives found 22% of healthcare organizations suffered at least one attack aimed at devices. When attacks do occur, they can threaten patients’ lives and cost healthcare organizations millions of dollars. As of March 2023, the FDA requires all new medical device submissions to include evidence the devices are cybersecure, a software bill of materials, and a plan to monitor and address cybersecurity vulnerabilities post-market. But these requirements do not apply retroactively, and many providers still use older medical devices with legacy operating systems—73%, according to a 2021 survey by cybersecurity company Kaspersky. On Oct. 1, for instance, the FDA recalled a heart pump controller over concerns it could be hacked. Its manufacturer, Johnson & Johnson’s Abiomed, advised users to disconnect the device from their network until a security fix was available. “The bad guys, once they’re in the network, may deploy ransomware, which encrypts the pathways to medical devices—potentially the medical devices themselves—denying the availability of the device for clinicians and patients. That’s where the real potential risk and harm is,” John Riggi, national advisor for cybersecurity and risk at trade and lobbying group the American Hospital Association, said. Keep reading on Healthcare Brew.—CC, EH | 
Guide → 
Guide →