Transforming Healthcare: Protecting Legacy Medical Devices from Cyber Threats

Summary

• Legacy Medical Devices Are Vulnerable: Many older devices in hospitals run outdated software and can’t be adequately protected against current attacks.
• Importance of Protecting Patient Data: Patient records and device safety are both at risk.
• Government and Industry Initiatives: Congress held a hearing on April 1, 2025, and the FDA has issued device security guidance.
• Strategies for Future-Proofing: Hospitals need ways to protect devices they can’t easily replace.

Old devices, new threats

Many medical devices still in use were built before cyberattacks were a serious concern. They include patient monitors, infusion pumps and imaging systems, and they’re central to patient care. But they often run old software that can’t be patched, which leaves them exposed.

On April 1, 2025, the House Energy and Commerce Subcommittee on Oversight and Investigations held a hearing titled “Aging Technology, Emerging Threats: Examining Cybersecurity Vulnerabilities in Legacy Medical Devices.” Witnesses described how outdated software and unsupported devices put patient data, and possibly lives, at risk. A breach can halt hospital operations.

Why patient data is a target

Health records are valuable to criminals. A single record can hold names, birth dates, insurance details and medical history, which can be used for identity theft, fraud and even blackmail.

Data is only part of it. If a device stops working or gives wrong readings, patients can be harmed. Encryption, network isolation and strict access controls help protect both the data and the devices.

What Congress and the FDA are doing

Government and industry are working on the problem. The U.S. Food and Drug Administration (FDA) has issued guidance on building security into medical devices. Congress is looking at whether rules for older devices need to be tightened.

Subcommittee Chairman Gary Palmer said in his opening statement that vulnerable legacy devices threaten patient safety and hospital operations. The hearing itself shows that lawmakers now treat device security as a patient safety issue. Greg Garcia of the Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group was among the witnesses.

Protecting what can’t be replaced

Hospitals can’t swap out every old device overnight. They’re expensive. So the work focuses on protecting them where they are, by isolating them on separate networks and watching for unusual traffic, using AI-assisted monitoring where it helps.

Training matters too. Clinical staff and IT teams who know the warning signs can act fast and stop a breach early.

What hospitals need now

Healthcare depends on technology that has to be secure. As threats grow, protecting legacy devices needs lawmakers, manufacturers and hospitals working together.

For hospitals, the first step is an inventory: know which devices are old, what they connect to and which ones can’t be patched. Everything else builds on that.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.