HHS Layoffs Threaten Medical Device Security: A Cyber Health Crisis Looms

HHS cuts raise medical device security worries

At a glance

• Impact on Cybersecurity: April 2025 layoffs at the Department of Health and Human Services (HHS), including about 200 jobs at the FDA’s device center, have raised concerns about medical device security oversight.
• Emerging Threats: Hospitals and device makers face constant ransomware and data theft attempts.
• Key Stakeholders: Device makers, hospitals and federal agencies all depend on FDA device security work.
• Future Concerns: Critics warn the cuts could slow the FDA’s response to a major device security incident.

Why the HHS layoffs matter for devices

HHS began large-scale layoffs in April 2025, cutting about 3,500 jobs at the Food and Drug Administration. The FDA’s Center for Devices and Radiological Health (CDRH), which oversees medical device safety, including cybersecurity, lost roughly 200 positions.

Reviewers were mostly spared, according to trade press reports. Support staff were not: policy, IT and communications teams were hit hard, and House Democrats warned that the cuts could weaken the FDA’s ability to review device cybersecurity and respond to incidents.

Devices on hospital networks

Medical devices, from infusion pumps to imaging systems, increasingly connect to hospital networks. That makes them a way in for attackers. Hospitals have faced a steady run of ransomware attacks in recent years, some of which knocked devices and records offline for weeks.

Hospital leaders have long argued that cyberattacks on hospitals threaten patient safety, not just data.

Who feels the effects

Fewer FDA staff could affect device makers, hospitals and other agencies. Manufacturers rely on FDA guidance and reviews to meet security requirements, and hospitals rely on FDA alerts when a device flaw is found.

Other agencies, already stretched, could end up picking up more of the work. Without extra people.

What experts want

Security experts have called for stronger public-private partnerships, investment in better security tools and laws that can adapt as threats change.

Waiting for an incident before acting is not an option in health care, they argue.

With federal support thinner, more of that work may fall on manufacturers and hospitals themselves.

Closing the gaps

Industry leaders and policymakers will need to work out how device security gets done with fewer federal staff, which means deciding plainly which work the FDA keeps and which falls to manufacturers, hospitals or other agencies.

If device flaws go unaddressed, the risk could become a patient safety problem. Device makers should keep up their own vulnerability disclosure and patching programs regardless of FDA staffing.

Hospitals should keep an inventory of connected devices and segment them from the rest of the network. Those steps don’t depend on Washington.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.