A nationwide assessment conducted by a healthcare cybersecurity consortium has found that a large proportion of connected medical devices in hospitals across the country are running severely outdated and unpatched operating systems, creating serious cybersecurity risks that could have direct implications for patient safety. The assessment found devices running operating systems no longer supported by their developers, including versions of Windows that have not received security updates in over a decade.

The affected devices include infusion pumps, patient monitors, imaging equipment, and laboratory analyzers — all connected to hospital networks and communicating with electronic health record systems. Many of these devices cannot be easily updated due to regulatory constraints: changing software on an FDA-cleared device may require the manufacturer to go through a recertification process.

"We have a perfect storm of technical debt and regulatory complexity creating a situation where critical medical devices are operating with known, exploitable vulnerabilities," said Dr. Thomas Bridges, a biomedical engineering security specialist. "In a worst-case scenario, this could enable an attacker to manipulate drug dosages or alter test results."

Several healthcare systems have begun implementing compensating controls, such as network segmentation to isolate vulnerable devices, enhanced monitoring for unusual device communications, and contractual requirements for medical device manufacturers to maintain cybersecurity standards throughout a device's lifecycle.

Regulators are working on updated guidance for medical device cybersecurity that would require manufacturers to build in more robust security capabilities and provide clearer patching mechanisms from the outset.