Cybersecurity in Hospitals: Between Medical Technology and Residual Risk

Klaus Mochalski and Silvia Seeger (Cyber Risk Manager at ⁠Relyens) shed light on the specific challenges of cybersecurity in the healthcare sector. Learn why medical technology plays a unique role between IT and OT, and why rigid manufacturer approvals make it difficult to patch legacy devices.

Duration:

26 min

Guest in this episode:

Silvia Seeger

Cyber Risk Manager ⁠Relyens

FAQ

Facts on the topic

How does medical technology differ from traditional IT and facility management systems in a hospital?

In a hospital environment, three distinct technology worlds intersect, each with its own unique security requirements:

Traditional IT: Servers, PCs, printers, and firewalls, which are typically well-secured according to established IT standards.
Facility Technology / OT: Building automation systems, elevator controls, and HVAC systems designed to maintain physical facility operations.
Medical Technology: Devices used for diagnostics, therapy, and patient treatment (e.g., MRI machines, CT scanners, infusion pumps, or digital ECG devices).

The Challenge: Many medical devices run for decades on proprietary or legacy operating systems (e.g., Windows 7 on CT control workstations). Due to strict vendor regulatory approvals, operators cannot simply install off-the-shelf antivirus software or apply patches unilaterally.

Why does a dangerous responsibility gap often open up around networked medical devices?

When integrating medical devices into the digital clinical network (e.g., connecting them to electronic health records), a lack of operational clarity frequently arises between IT and medical engineering departments:

The IT Perspective: IT provides the physical connections, ports, and network segments, assuming the device's ongoing management remains solely the responsibility of medical engineering.
The Medical Engineering Perspective: They assume that because the device is plugged into the IT network, the IT team automatically applies standard cybersecurity controls.
The Consequence: Critical safeguardssuch as continuous vulnerability management, patch and change management, or managing end-of-life systemsfll through the cracks.

What regulations and security standards govern IT/OT security in hospitals?

Because general IT security standards like ISO 27001 often fall short for day-to-day clinical operations, hospitals rely on industry-specific frameworks:

B3S Hospital Standard: The Sector-Specific Security Standard for Healthcare supplements ISO 27001 by introducing two essential security objectives: patient safety and treatment effectiveness.
Medical Device Operator Ordinance (MPBetreibV): With the addition of Section 17 MPBetreibV, operators are explicitly required to conduct independent IT security assessments for medical devices that consist of or run software.
MDR (Medical Device Regulation): Regulates manufacturer requirements across the entire product lifecycle at the European level.

Why are hospitals a primary target for cyberattacks and ransomware?

Hospitals are increasingly targeted by cybercriminals due to the exceptionally high black-market value of stolen clinical data:

High Data Value: Stolen personal health information (PHI) often fetches three times the price of standard personal data on the black market (around $60 compared to $20 per record).

No More Mercy: While attackers in the past occasionally backed off when realizing they had hit a hospital, modern malware and phishing campaigns are deployed indiscriminately ("spray-and-pray").

Resource Constraints: Severe staffing shortages and tight financial budgets make it difficult for many hospitals to maintain flawless, comprehensive preventative defenses.

Summary

‍

Sound Bites

Silvia Seeger: “I basically see it as three groups [...] first, traditional IT, [...] then I tend to classify building automation as part of industrial engineering [...] and then, as a third group, medical technology.”

Silvia Seeger: “I have a specific configuration; the medical device manufacturer uses this to obtain its approval and bring the product to market, and I’m not allowed to just change anything. That means I’m also not allowed to simply install an antivirus program on a medical device.”

Silvia Seeger: “[...] then the device is integrated, but usually the IT department no longer feels truly responsible[...] and in the end, there’s a major risk that a gap in responsibility will arise—that no one feels responsible—and that things like vulnerability management or patch management [...] don’t take place.”

Silvia Seeger: “Ideally—or to add to that—there’s the so-called industry-specific Hospital B3S security standard, [...] because it incorporates these specific requirements [...] as well as two additional protection goals: patient safety and treatment effectiveness.”

Silvia Seeger: “A standard set of personal data would be worth around $20. But if it’s personal health data, then around $60. So the ratio is roughly one to three [...]”

Silvia Seeger: “Once I’ve done my homework, [...] I’ll certainly still have some residual risk left. [...] And now, for the sake of resilience, I’m transferring that residual risk, because I know it’s no longer a question of whether an attack will hit me, but only a matter of when.”

‍