The Complexity of Managing Medical Device Security Risk

The tens of thousands of very specialized types of medical devices used in clinical settings contain multitudes of diverse architectures and systems. That myriad of technical specifications adds to the complexity healthcare organizations and manufacturers face in managing cybersecurity risk, says Phil Englert, director of medical device security at the Health Information Sharing and Analysis Center. “It’s very difficult for organizations to understand and quantify where the risks lie, how to put programs in place and how to approach this,” he says. But those challenges are not faced only by the healthcare entities that use these devices, he says. “It’s also the manufacturers themselves – especially the large ones that have multiple product lines that are distinctively different from each other. It’s difficult to say, ‘This set of controls will work ubiquitously across these technologies,'” he says.