HHS Staffing Cuts Threaten Medical Device Cybersecurity Safeguards

HHS Staffing Cuts Threaten Medical Device Cybersecurity Safeguards

Summary

• HHS job cuts announced in early 2025 have raised worries about oversight of medical device cybersecurity.
• Fewer reviewers and less expertise could mean weak spots in connected devices go unnoticed for longer.
• Hospitals, manufacturers and security researchers say device security has to keep improving despite the cuts.
• The Food and Drug Administration (FDA) still enforces cybersecurity rules for new devices, but with fewer people to do it.

Overview

Connected medical devices are a real target for attackers, and keeping them safe depends on regulators who know what to look for. In late March 2025 the Department of Health and Human Services (HHS) announced a restructuring that would cut about 10,000 jobs, including roughly 3,500 at the FDA. This article looks at what those cuts could mean for device security, where the risks are, and how the industry is responding.

Impact of HHS Staffing Cuts on Cybersecurity

The cuts worried people across healthcare right away. Job losses take experience with them, and that experience is hard to replace. Fewer reviewers means slower risk assessments, less monitoring once devices are on the market and slower responses when a flaw turns up. That matters for medical devices, where a security failure can put a patient at risk, not just a database.

Potential Vulnerabilities in Medical Devices

Infusion pumps, imaging systems, monitors and implants now connect to hospital networks, and many of them send patient data. That makes them targets. A successful attack could change how a device behaves, expose health records or shut down care at a hospital.

Dr. Suzanne Schwartz, director of the FDA’s Office of Strategic Partnerships and Technology Innovation in its device center, has spent years warning that cybersecurity is a patient safety issue, not only an IT one. She has led much of the agency’s work on device security.

FDA’s Role and Industry Response

The FDA’s main tools are already in law. Since March 2023, section 524B of the Food, Drug, and Cosmetic Act has required makers of “cyber devices” to include cybersecurity details in premarket submissions. That covers a software bill of materials, a plan to monitor and fix vulnerabilities, and proof the device was designed securely. The agency’s September 2023 guidance spells out what reviewers expect.

Industry groups are not waiting for regulators. Manufacturers, hospitals and researchers share vulnerability information through groups such as Health-ISAC and coordinated disclosure programs. Many larger device makers now run their own product security teams.

The open question is capacity. Rules only work if there are enough trained people to review submissions and follow up on problems.

Looking Ahead

The HHS cuts raise a simple question: who will check that connected devices are safe? Threats against hospitals keep growing. Device security needs steady funding and experienced staff.

Manufacturers, hospitals and regulators will need to keep working together. Patient safety depends on it. Lawmakers and agency leaders also need to decide whether the cybersecurity workforce at HHS and the FDA is big enough for the job it has been given.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.