Op-Ed: When a hospital can’t patch a machine, what’s the backup plan?

According to Health-ISAC’s MedTech Security Baselines paper, while a device with a known vulnerability remains in use, the hospital must have a documented risk management plan with named responsibility owners and timelines, along with a register of the risk that remains.

Given that the global health sector was victim to 575 ransomware attacks in 2025, up from 476 a year earlier, the risk is real if you don’t have a vulnerability management program, along with an incident response and recovery plan. A compromised device can expose patients’ sensitive personal and health information, provide attackers access to the hospital network, result in degradation or disruption of clinical systems and technologies crucial for service delivery and patient care, and open up the entire organisation to fraud and extortion by cyber criminals.

How a hospital manages vulnerabilities and mitigates risk, particularly for technologies that are difficult to patch, is a determining factor in its resilience to cyber incidents.

Take the time to understand what the vulnerability means for you

Vulnerability notices may be useful for cyber security teams, but for hospitals, just the awareness of a potential security gap does little to help managers and personnel determine how serious the implications are for a specific device on a specific ward, and for patients the device provides care for. Optimally, biomedical engineers and cyber security personnel make that determination together, with input from the clinicians who use the equipment every day and know what taking it out of commission would mean for their patients.

The sheer breadth of medical devices that require this level of review is considerable. A 2023 study by security firm Claroty found 14 per cent of connected medical devices were running operating systems that were either unsupported or nearing the end of their support period.

VIEW ALL

For hospitals assessing such vulnerabilities, it’s most useful to start with how a device could be reached from the mindset of an attacker. Reduce ways to exploit attacks through architecture and configuration. From there, establish the impact of the vulnerability: Could it result in loss of function or loss of control of the medical device? Could it result in someone gaining access to the hospital network, or enable an attacker to exfiltrate patient or hospital data? Each system component may also need an individual assessment – for instance, a CT scanner’s operator console can often be locked down, similar to an office PC, though the embedded controller in the CT scanner may offer fewer options.

Once cyber security and health teams have a clear picture of the risk presented by a device with a vulnerability, ensure leadership, such as the chief information officer or director of medical services, is informed and accepts the risk. In larger health systems, such decisions are often managed by a clinical risk or digital health governance committee.

As for manufacturers, they remain bound by their obligations under medical device regulations. The Therapeutic Goods Administration (TGA) has extensive medical device cyber security requirements, including for software and AI components. Hospitals have a shared responsibility in cyber security as an end user of medical devices, with the TGA providing guidance for small business operators and large-scale service providers.

Waiting isn’t always a bad decision if you do it knowingly

If a hospital is still running a vulnerable device that you can’t afford to decommission right away – for example, an endoscopy tower – the organisation is accepting risk for that period. Provided such decisions are made within the governance structure, with a review date, you end up with a documented, managed exception that can be revisited as circumstances change.

The good news is, you can build solid defence-in-depth protections around legacy devices that are no longer reliably supported by their vendors. For example, a hospital can place an older device in a sandboxed network segment to tightly limit access and close off ports and services it has no clinical use for.

In addition, monitoring the network for any compromised systems adds an early warning mechanism – you don’t want an old X-Ray machine to suddenly start pinging an unfamiliar external address due to malware without your security teams knowing about it.

Hospitals, specifically those listed as designated hospitals under the Security of Critical Infrastructure Act 2018 (SOCI Act), must operate a Critical Infrastructure Risk Management Program (CIRMP) requiring the identification, governance, treatment and ongoing review of material cyber, personnel, supply chain and physical security risks, with controls designed to minimise or eliminate those risks so far as reasonably practicable.

Of course, compliance alone may not effectively mitigate risk, so it is important to implement other, more effective measures.

Plan for the day things will go wrong

Strong protections around a device may reduce the chances of it getting compromised; however, it is essential for hospitals to be prepared and have tested plans for a cyber incident, including impact to medical devices.

In 2021, Eastern Health, a Melbourne metropolitan health service in Victoria, was the victim of a ransomware attack, which led the health service to postpone all but the most urgent elective surgeries for several weeks, and its staff had to go back to manual processes. Although this incident only affected IT systems, it yielded lessons that can generally be applied to preparedness and business continuity plans for medical devices.

Start by identifying which devices you can’t replace, and what the consequences will be for the patients. Think about the possibility of having trusted and standby backup equipment elsewhere in the building, or a plan to transfer equipment from non-critical care settings to critical care settings. Also consider a supply arrangement with another organisation, or the vendor, in the event of an incident. Further, think about setting up a contingency fund, as some legacy systems may not be recoverable after a serious incident, and when there’s an emergency, a replacement will not be available within your regular procurement timelines.

To put those plans to the test, run discussion and functional exercises, with realistic scenarios of compounding and cascading events impacting the hospital, and capture lessons learned to update plans and staff training.

Be ready before the fix arrives

Most hospital IT and biomedical engineering staff already know which devices they won’t be able to patch on demand. When patching is hard or impossible, this is where your defence-in-depth tactics come to the fore. Ensure someone in the organisation is responsible for any exceptions, that mitigations are in place to reduce exploitation through architecture and configuration, and you have a tested plan to respond when things go wrong that maintains service delivery and patient safety.