How Has Medical Device Cybersecurity Become a Patient Safety Priority?
Phil Englert, director of medical device security at Health-ISAC, says he has watched the transformation of medical device security — from a niche technical concern to a critical pillar of patient safety and operational resilience — unfold over decades of working inside hospitals and health systems.
He explains that when cybersecurity first emerged as a concern, few organizations understood the implications.
That gap reflected the broader reality of healthcare IT environments, where medical devices represent a relatively small but highly specialized portion of connected infrastructure.
“Medical devices represent between 5% and 11% of the endpoints, while your Internet of Things and operational technology population represents about 30%,” Englert says. “The rest are the traditional IT endpoints we’re used to.”
Today, with connected devices generating vast volumes of clinical data and playing a central role in diagnosis and treatment, securing them has become essential not only for data protection but also for ensuring care delivery itself.
How Can Organizations Bridge Healthcare and Cybersecurity?
Health-ISAC plays a central role in helping healthcare providers, manufacturers and government agencies navigate the evolving cybersecurity landscape. The member-driven organization facilitates threat intelligence sharing, risk analysis and collaboration across the healthcare ecosystem.
“We have more than 1,000 member organizations worldwide, with about 12,000 staff involved,” Englert says. “We share indicators of compromise and threat intelligence between our members and also share best practices, whether that’s policies, tools or other practices.”
The organization also serves as a critical intermediary, translating technical vulnerabilities into clinical risk terms that healthcare providers can act on.
“We curate alerts and try to address whether should you care, how much should you care and what should you do about it,” Englert says.
He adds that translation is essential because technical cybersecurity metrics alone do not fully capture clinical risk.
“We apply that to how it impacts clinical functionality,” Englert says. “Does a bad actor get root access? Can they change operating parameters, access data or move laterally? We put that in clinical terms so hospitals can make more informed decisions.”
READ MORE: Resilience is the new frontier of AI performance.
What Are the New FDA Cybersecurity Requirements for Medical Devices?
The new FDA cybersecurity guidance reflects growing concern that vulnerable devices pose not just technical risks but direct threats to clinical operations and patient safety, particularly as hospitals rely on increasingly connected technologies for monitoring, diagnosis and treatment.
“Vendors must provide a software bill of materials, manage the risks of those components, develop their product under a secure software development program and provide those SBOMs to customers upon demand,” Englert says.
These requirements reflect a broader recognition that cybersecurity directly affects patient safety. Historically, the FDA focused primarily on evaluating whether devices performed their intended medical functions. Now, regulators are also examining whether devices can be compromised or misused.
“Cybersecurity engineering is about preventing devices from doing tasks you don’t want or expect,” Englert says. “The FDA identified this as a software quality issue, which is important because protecting device functionality ensures they remain safe for patient use.”
The stakes are high, particularly given the scale and complexity of healthcare environments: Englert points out a 300-bed hospital generates about 1.37 terabytes of data a day.
“A lot of that comes from medical devices,” he says. “Making sure those devices are available and that the data remains accessible is essential to providing care.”
