A biomedical technician calibrating a medical imaging device in a hospital

How organizations can deliver medical device security the care it needs

Authors

5 minute read 17 Sep 2025

Many smart medical devices in health care today are not designed with security in mind, exposing sensitive data to risk.

In brief
  • Existing medical devices are not designed with cybersecurity in mind
  • Unprotected devices can expose sensitive patient and organizational data to criminals
  • Manufacturers must adopt a secure-by-design approach to protect devices

Diagnosing and treating the root causes of cybersecurity challenges and vulnerabilities in the health and life sciences sectors used to be simpler. The rapid growth of internet-connected medical devices in health care is expanding the cyber risk landscape dramatically. As the smart medical device market is set to exceed $125.5 billion by 20331, organizations must recognize and respond to the broad cybersecurity risks these devices now bring — from outdated legacy systems to insecure third-party components. This growth will likely rise as more sectors pursue a direct-to-consumer service model and increase remote patient care options. While technological advances bring incredible care, research and medical device manufacturing opportunities, they also lead to a much larger threat landscape. Many organizations are unprepared for the implications and necessary steps to align their cyber capabilities. This ultimately exposes organizations to operational risk, reputational damage from cyber incidents, financial losses and, most importantly, threats to patient health and safety. If this is not yet a concern for your business leaders, it almost certainly should be. Understanding the way medical devices are changing risk is now essential for health and life sciences sector leaders. It is time to adopt a “secure by design” approach to device protection. Let’s take a look at the key factors to consider.

How EY can help

Scale of the risk landscape

The outlook is clear. The increasing number of connected devices integrated into health care services means more risk. In hospitals, as much as 53% — more than half — of connected medical devices have been found to have known vulnerabilities.2 More than one-third (33%) of Internet of Things (IoT) devices have been identified as having critical risk factors that will impact operation and functionality,3 and according to the U.S. Government Accountability Office (GAO), there is an average of 6.2 present vulnerabilities per medical device4 — meaning the threat to health care providers is no longer theoretical. The problem could worsen as US health care expenditure is set to reach $7.2 trillion by 2031.5 All this significantly increases the likelihood of ransomware attacks, operational disruption, regulatory penalties and, most importantly, harm to patient safety.

 

Secure by design: building for performance and protection

The challenge in medical device cybersecurity is not new. Health care providers and organizations frequently, for budgetary or process reasons, use legacy devices and outdated software, making security difficult in today’s evolving risk landscape. According to a HIMSS Healthcare Survey, 50% of oncology, pharmacology and laboratory departments operate on outdated Windows software incapable of receiving updates. Furthermore, interoperability across the health care ecosystem can increase vulnerabilities too, especially if proper authentication and encryption measures are not in place.

While many legacy devices designed for patient outcomes perform well, they were not built with cybersecurity in mind and are unable to implement the essential firmware and software updates that are now critical for protecting both devices and data. To protect devices, health care organizations and patient care going forward, manufacturers are now adopting a secure by design philosophy where cybersecurity is integrated into the development lifecycle of medical devices — not treated as an afterthought. This means balancing clinical performance with security from day one. By utilizing this approach, medical device manufacturers and health care providers do not have to choose between patient outcomes and cyber protection — they can and must deliver both. This approach incorporates consideration of risk, exposure and possible threat into the design process along with practical and functional patient care performance.

Suggested measures for regulatory compliance

Given guidance from the Food and Drug Administration (FDA), released in June 2025, along with Health Insurance Portability and Accountability Act (HIPAA) regulations related to data protection and patient privacy, organizations should continue to establish or refine product security capabilities across three dimensions: people, process and technology. Steps include:

  • Improving accountability for product security by utilizing a qualified, skilled and central function employing security advocates within the product and device development teams to provide strategy, oversight and management of vulnerabilities and responses. This function will systemize security enhancements and maintain central control.
  • Utilizing a post-deployment customer support function to formally integrate medical device security and privacy considerations into post-deployment activities, including checklists for decommissioning connected products or transferring ownership.
  • Clarifying roles and responsibilities across multiple functional areas, including product management, supply chain, manufacturing, commercial sales, marketing, field services and customer support as well as legal, regulatory and information technology.
  • Tracking the medical device lifecycle to provide a single source of truth for cyber-relevant product information, automated processes to maintain inventory and insights into product security deliverable compliance. This enables informed business decisions around compliance and product security deliverables; helps to manage conversions; and supports better compliance, FDA reporting, and incident management times and procedures.
  • Establishing software bills of materials (SBOMs) to control sourcing, quality and security of third-party parts and materials for secure device design.
  • Implementing continuous product improvement of security capabilities by conducting periodic cyber and product security program assessments to guide further action and the adjustment of risk profiles.

Technical steps to enhance device security

As health care organizations implement the measures necessary to evolve medical device design and development processes for improved compliance, the following required steps across the people, process and technology dimensions should be considered:

Mehul Purohit, Justin Munier, and Sharon Cohen contributed to the development of this article.


Summary 

Unsecured devices are no longer just IT risks — they are clinical, financial and reputational ticking threats. Failure to act today invites not only cyber threats but also loss of trust, regulatory consequences and potential patient harm tomorrow. As the sophistication of cyber attacks and the overall risk landscape for connected devices grows rapidly, it is important for manufacturers and the organizations that use these devices to prioritize performance and cyber protection. Devices and products must be designed, manufactured, operated and governed with the same high levels of due diligence that organizations now afford sensitive and proprietary data. Failure to protect devices adequately will only lead to further vulnerabilities, patient data exposure and potentially irreparable damage to an entity’s reputation.

About this article

Authors

Related topics
Life sciences
Cybersecurity

Related articles

4 strategies for healthcare CISOs to build cyber protections on a budget

What can cyber leaders across the health care sector do to protect their business, patients and care delivery? Here are four priorities for consideration:

Nana Ahwoi

How Medtronic’s optimized supply chain gets products to patients in need

A global technology Life Sciences leader improved their supply chain planning to better serve patients. Learn more in this case study.

How Bayer is unearthing agronomy's future with generative AI

Read this case study to learn how Bayer Crop Science is using large language models to plant the seeds of the future.

    EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.