RFID and Medical Device Cybersecurity

Part of our NFC and RFID security series for medical devices. For the full overview, start with NFC & RFID Security in Medical Devices: A §524B.

Updated November 16, 2024

As electronic medical records, telemedicine, and connected devices spread across healthcare, protecting patient data and securing medical devices matter more than ever. One technology with a growing role in medical device security is RFID (Radio Frequency Identification).

Key Takeaways

• RFID ensures accurate identification and authentication of medical devices.
• Real-time tracking with RFID prevents device loss and supports integrity.
• Limitations include signal interference and initial infrastructure costs.
• Emerging RFID trends offer enhanced security features and capabilities.
• Integration with blockchain could provide tamper-resistant data management.
• FDA guidance emphasizes secure product development and post-market updates.

Table of Contents

• Key Takeaways
• Understanding RFID Technology
• The Role of RFID in Medical Devices
• Cybersecurity Threats in Healthcare
• RFID as a Cybersecurity Solution
• Future of RFID in Medical Device Cybersecurity
• Medical Device Cybersecurity FAQs

Why this matters

The security of medical devices is critical, directly impacting patient safety, data privacy, and the operational integrity of healthcare systems. A compromised medical device can lead to patient harm, data breaches, and significant financial and reputational damage to healthcare providers and device manufacturers. RFID offers a vital layer of defense by enabling precise identification, authentication, and real-time tracking of devices, mitigating risks such as counterfeiting, unauthorized access, and supply chain vulnerabilities.

The FDA's "Cybersecurity in Medical Devices" Final Guidance, dated February 3, 2026, emphasizes the necessity for robust cybersecurity throughout the product lifecycle, from design to post-market surveillance. This guidance highlights the importance of capabilities like secure device identification and integrity checks, areas where RFID technology can play a significant role. Adherence to standards such as IEC 80001-1 (Application of risk management for IT networks incorporating medical devices), ISO 27001 (Information security management systems), and AAMI TIR57 (Principles for medical device security, Risk management) is crucial. Effective cybersecurity measures, including those augmented by RFID, are not merely compliance requirements but fundamental components of safe and effective medical device deployment and operation.

Understanding RFID Technology

RFID is a wireless technology that uses radio waves to identify and track objects. It has three main parts: a tag, a reader, and a backend system. The tag, usually attached to an item, stores a unique identifier the reader can read. The reader uses an antenna to capture the tag’s information and send it to the backend system for processing.

RFID is used across retail, logistics, healthcare, and manufacturing. In retail, RFID tags improve inventory management with real-time data on stock levels and item locations. In healthcare, RFID systems track medical equipment, monitor patient flow, and help ensure medications are administered correctly.

What is RFID?

RFID stands for Radio Frequency Identification. It is an automatic identification technology that uses radio waves to identify and track objects. When RFID tags are attached to objects, they can wirelessly communicate identity and other relevant information.

RFID technology includes passive, active, and semi-passive systems. Passive RFID tags do not have an internal power source and rely on the reader’s signal to transmit data. Active RFID tags have their own power source, which lets them broadcast over longer distances. Semi-passive tags combine elements of both and balance range with power use.

How Does RFID Work?

RFID works through electromagnetic coupling. When the reader emits a radio signal, the RFID tag receives it through its antenna. The tag uses energy from the reader’s signal to power its internal circuitry, then sends back a response containing its unique identifier and any additional stored data.

A key advantage of RFID is real-time tracking and tracing. In supply chain management, RFID can improve visibility, reduce errors, and increase inventory accuracy. That helps organizations optimize processes and reduce losses.

The Role of RFID in Medical Devices

Medical devices support diagnosis, treatment, and monitoring. RFID can improve both their security and their operational use.

Types of Medical Devices Using RFID

RFID is used in implantable devices, drug delivery systems, surgical instruments, and hospital beds. These devices use RFID tags for real-time tracking, inventory management, and authentication.

Implantable medical devices, such as pacemakers and neurostimulators, often include RFID tags that store important patient information. That gives clinicians quick access to key data in an emergency. Drug delivery systems, such as insulin pumps, can also use RFID to support accurate dosing and track medication adherence.

Benefits of RFID in Medical Devices

Adding RFID to medical devices gives healthcare facilities several benefits. RFID supports fast, accurate device identification, which cuts down on human error. It also improves inventory management, so the right equipment is available when needed. RFID supports asset tracking as well, which helps reduce loss or theft of expensive devices.

RFID can also improve patient safety. RFID-enabled surgical instruments can be tracked during procedures to help confirm the right tools are in use. Hospital beds with RFID tags can help staff monitor patient movement and improve bed utilization.

Cybersecurity Threats in Healthcare

As healthcare becomes more digital, cybersecurity threats keep growing. Attackers look for weaknesses in medical devices and networks that can put patient data and patient safety at risk.

Healthcare is a prime target because it stores large amounts of sensitive data. That includes patient records and intellectual property that can be sold on the dark web. This makes healthcare organizations frequent ransomware targets, where attackers encrypt critical data and demand payment.

Common Cybersecurity Vulnerabilities in Medical Devices

Medical devices often have weak security controls, which makes them vulnerable to attack. Outdated software, weak or default passwords, and missing encryption can all let attackers gain unauthorized access, manipulate data, or disrupt device function.

The interconnected nature of healthcare systems adds another problem. As more devices connect to the internet for remote monitoring and data collection, the attack surface grows. One weakness can expose an entire network and lead to broad data breaches or system failures.

The Impact of Cybersecurity Breaches in Healthcare

Cybersecurity breaches in healthcare can have severe consequences. Beyond exposing patient data, they can lead to medical identity theft, inaccurate records, and direct patient harm. If attackers gain control of medical devices, they may alter dosages, change treatment plans, or create life-threatening conditions.

A breach also damages trust. Patients may lose confidence in how their data is handled, and the organization may face legal consequences. Recovering from that takes more than fixing the immediate issue. It also requires stronger security measures and clear communication with patients and stakeholders.

RFID as a Cybersecurity Solution

RFID can help improve medical device security in healthcare.

As healthcare keeps adding connected and IoT devices, security demands increase. RFID gives medical devices unique identifiers that can support stronger security controls.

How RFID Enhances Medical Device Security

By adding RFID tags to medical devices, healthcare providers can use authentication protocols to verify that devices are legitimate. RFID can also help create a secure communication channel between devices and support encrypted data transmission. It also allows real-time monitoring of device integrity to detect unauthorized tampering or modification.

RFID can also improve inventory management, keep devices accounted for, and reduce theft or loss. That improves both security and day-to-day operations.

Limitations and Challenges of RFID in Cybersecurity

RFID has limits. One major issue is signal interference, which can reduce system accuracy and reliability. Cost is another barrier. Building RFID infrastructure across healthcare facilities can be expensive.

Interoperability is also a challenge. RFID systems need to work with existing IT infrastructure, electronic health records, and other security controls. Without that, organizations will not get the full benefit.

Future of RFID in Medical Device Cybersecurity

The role of RFID in medical device cybersecurity will keep changing as technology advances and new threats appear.

Emerging Trends in RFID Technology

RFID technology is improving through smaller and more durable tags, better range and accuracy, and stronger data encryption. These advances should improve both security and effectiveness in medical device applications.

Predictions for RFID and Cybersecurity in Healthcare

Experts expect RFID to become more deeply integrated into medical device cybersecurity strategies. With continued research and development, RFID will keep adapting to changing cybersecurity threats in healthcare.

One area to watch is real-time tracking and monitoring of medical devices. RFID tags paired with sensors can provide data such as temperature, location, and usage patterns. That can improve inventory management, patient care, and operational efficiency.

Integrating blockchain technology with RFID in medical device cybersecurity could also improve data integrity and security. Blockchain’s decentralized, tamper-resistant model combined with RFID tracking can create a more transparent and secure way to manage medical device data. That could reduce the risk of data breaches and unauthorized access while helping protect patient information.

Conclusion

As healthcare organizations keep adopting RFID to improve medical device cybersecurity, they also need experienced security support. Blue Goat Cyber focuses on medical device cybersecurity and helps organizations address HIPAA and FDA compliance with a proactive security approach. Contact us today for cybersecurity help if you need help securing medical devices and patient data.

Check out our medical device cybersecurity FDA 510(k) submission package.

How Blue Goat approaches this

Blue Goat Cyber assists medical device manufacturers and healthcare organizations in integrating and securing RFID technologies within their ecosystems. Our approach begins with a detailed assessment of existing infrastructure and potential vulnerabilities, followed by strategic recommendations tailored to specific needs. We develop protocols for secure RFID implementation, including encryption, access control, and anomaly detection to counter signal interference and data interception risks. Our team, comprised of CISSP and OSCP certified experts, including ex-military red team personnel, applies a meticulous methodology to identify and address weaknesses.

We provide specialized services such as threat modeling and penetration testing to ensure RFID systems meet stringent security requirements. For FDA submissions, we focus on demonstrating security controls that align with regulatory expectations. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost. We offer thorough support, from initial design consultation to post-market monitoring and incident response planning. Our objective is to enhance the security posture of medical devices, safeguarding patient safety and data confidentiality. Learn more about our specialized services at: /services/fda-premarket-cybersecurity-services.

Medical Device Cybersecurity FAQs

How do I get a quote for a medical device test from Blue Goat?

Please schedule a 30-minute Discovery Session with us so we can best understand your objectives.

What insights does Blue Goat Cyber provide related to software testing in the healthcare industry?

Blue Goat Cyber provides several key insights related to software testing in the healthcare industry, focusing on comprehensive methods for various software and medical devices. They emphasize the importance of governance in cybersecurity programs, ensuring that medical software complies with regulatory standards like FDA guidelines and HIPAA. Blue Goat Cyber also stresses proactive risk mitigation, including strategies for identifying and managing potential vulnerabilities in healthcare software. Their approach includes educating healthcare organizations on cybersecurity risks and best practices, and promoting a culture of awareness and proactive security measures.

What are the security requirements that medical device applicants must now meet?

The U.S. Food and Drug Administration (FDA) has established specific cybersecurity requirements that medical device manufacturers must meet. These include:

1. Secure Product Development Lifecycle: Manufacturers are required to implement a secure product development lifecycle. This involves reducing the number and severity of vulnerabilities throughout the entire lifecycle of their devices, from design and development to distribution, deployment, and maintenance​.

2. Threat Modeling and Post-Market Vulnerability Management: Manufacturers must conduct threat modeling and outline plans for addressing post-market vulnerabilities. This includes patching and software updates to respond to potential security issues​​​.

3. Coordinated Disclosure of Exploits and Software Bill of Materials: Details of the methods for coordinated disclosure of exploits must be included. Manufacturers must also supply a software bill of materials (SBOM) that details all third-party commercial, open-source, and off-the-shelf software components used in their devices​​​.

4. Process and Procedures for Postmarket Updates and Patches: Companies must provide details on the processes and procedures for releasing postmarket updates and patches that address security issues. This includes regular updates and out-of-band patches for critical vulnerabilities​​.

These requirements apply to "cyber devices," which are defined as any devices that run software, have the ability to connect to the internet, and could be vulnerable to cyber threats. As of October 1, 2023, the FDA's refuse-to-accept policy comes into force for pre-market submissions that lack the required cybersecurity information​​​​.

Medical device manufacturers should familiarize themselves with the FDA's updated guidance document, "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions," to ensure their products meet the required cybersecurity standards. Failure to meet these requirements could result in the FDA rejecting pre-market submissions​​.

What new policy has the FDA announced for medical device manufacturers?

According to the recent announcement by the FDA, medical device manufacturers are now required to follow a new cybersecurity policy. Under this policy, all new applicants for medical devices must submit a comprehensive plan that outlines how they will actively monitor, identify, and address potential cybersecurity issues. This plan must also include steps to ensure that the device is adequately protected.

In addition, the FDA now requires applicants to establish a reliable process that reasonably assures the device's security. This includes taking necessary measures to make security updates and patches available regularly and in critical situations. Applicants must also provide the FDA with a detailed software bill of materials, covering any open-source or other software used in their devices.

Overall, this policy emphasizes cybersecurity in medical devices and is intended to ensure manufacturers take appropriate steps to protect patient safety and reduce cyber risk.

What is Blue Goat's methodology for medical device cybersecurity assessment for FDA compliance?

Blue Goat uses a two-step Assessment Evolution test/retest approach for optimal outcomes. Within each Evolution, in addition to the actual medical device assessment and testing components, we dedicate access to our cybersecurity team for report clarification and knowledge exchange, assisting in your understanding of the test findings and the remediation strategies.

Post-remediation of Evolution 1, we will again conduct the cybersecurity assessment and penetration test to assess the efficacy of addressing identified vulnerabilities. This second set of reporting demonstrates a more defensible security posture and, therefore, a more impactful Letter of Attestation.

Our overall medical device security assessment and testing process involves four high-level phases:

1. Discovery
2. Security Boundary Definition
3. Security Risk Assessment
4. Mitigation Strategy

Medical Device Assessment Evolution 1

1. Preparation (Offsite). Before we travel to your facility, we prepare for the onsite visit. Our preparation  consists of Discovery, such as a review of the following:

• Design documents
• Data flow diagrams
• Use cases
• Traceability matrix
• Security architecture
• User manuals
• Admin/maintenance manuals
• Installation procedures and guidance
• Risk assessment
• Hazard analysis
• Source code
• Total Product Life Cycle (TPLC) documentation
• Product photos
• Any other relevant device documentation

We intend to get familiar with your product, formulate a plan of action, and develop the Test Plan and Test Cass before our onsite visit. This allows us to optimize our time onsite.

2. T esting (Onsite or at Blue Goat's facility). We travel to your facility to perform the cybersecurity assessment and penetration test against your medical device/system. Testing can also be performed at Blue Goat’s facility if you ship the equipment to us. Our testing consists of identifying all entry points into the system, such as Ethernet, Fiber, WiFi, USB, BTLE, Serial, and HDMI. We assess vulnerabilities associated with each entry point and the exploitation of initial and subsequent vulnerabilities. Any critical findings discovered will immediately be brought to your attention. In addition, due to the nature of our engagement, we can share our test results with you daily as an end-of-day update.

3. Reporting (Offsite). At the end of testing, we generate a medical device cybersecurity assessment and penetration test report that ranks our findings based on criticality. The report will include step-by-step exploitation steps, described with screenshots. The report also includes remediation guidance for each finding.

4. Report Presentation (Offsite). Once the report is completed, we securely send it to you and review it via Zoom.

Between Evolution 1 and Evolution 2, you will work on fixing issues identified in Evolution 1.

Medical Device Assessment Evolution 2​

When you are ready for us to retest the medical device, we repeat the applicable steps of Evolution 1 in Evolution 2. This will be completed onsite at Blue Goat or your facility.

At the end of Evolution 2, we will generate a Letter of Attestation that summarizes the medical device's scope, findings, and overall risk rating. The Letter of Attestation is intended to be shared with clients, auditors, regulators, etc.

What is the goal of a penetration test against a medical device?

Blue Goat understands the importance of securing wired or wireless medical devices and protecting your business from cybercriminals. We assess the cybersecurity posture of your devices so we can identify vulnerabilities and weaknesses in their networks and infrastructure. By conducting a thorough penetration test, we help protect patient safety and reduce organizational risk.

During the penetration test, our team evaluates the security defenses of your medical devices and looks for potential entry points for cyberattacks. We examine hardware, software, peripherals, and all other input/output systems. Our experts fuzz, analyze, and test each area for flaws that could compromise patient care or the integrity of the device.

We also pay close attention to common vulnerabilities and exposures (CVEs) found in medical devices. We examine ways kiosked applications on these devices might be bypassed, making sure unauthorized access to underlying operating systems is not possible. This process can take hours or days to uncover a chain of flaws that would allow those controls to be bypassed.

We also assess the physical aspects of the device, including alternate ports such as JTAG, UART, other unprotected ports, additional USB ports, and accessible hard drives.

Our work also includes forensics and post-exploitation movement. We detonate payloads, pivot, and adjust operating systems to simulate real-world scenarios that could affect patient care. In addition, we reverse engineer proprietary binaries and programs, searching for sensitive keys to determine whether encryption uses static or dynamically created keys.

This penetration test gives you a full view of your medical device's security weaknesses. Our findings support detailed recommendations for patching and strengthening defenses, improving patient safety and reducing organizational risk.

What is AAMI TIR57?

AAMI TIR57 is a technical information report focused on the principles for medical device security-risk management. It's a guideline from the Association for the Advancement of Medical Instrumentation (AAMI), an organization well known for its work in medical devices.

Overview

AAMI TIR57, titled "Principles for medical device security-Risk management," provides a structured approach to managing cybersecurity risks in medical devices. This matters because medical devices, like other connected technology, can be vulnerable to cyber threats. The report gives guidance on implementing security measures throughout a device's lifecycle, from design and development to decommissioning.

The "Why"

TIR57 matters because it focuses on patient safety and data security. As medical devices become more interconnected and software-dependent, they become more exposed to cyber threats. Those threats can affect device functionality and lead to patient harm. TIR57 helps manufacturers and healthcare providers reduce these risks by establishing sound security practices.

Examples and Case Studies

For example, a hospital may use networked medical devices such as heart rate monitors or insulin pumps. These devices are critical to patient care. If they are compromised because of weak security, the result could be a data breach or a life-threatening event. Applying the principles in AAMI TIR57, such as performing risk assessments and including cybersecurity in device design, helps prevent those outcomes.

For Blue Goat Cyber, understanding and applying AAMI TIR57 means offering services aligned with these standards. That includes risk assessments, guidance on secure device design, and ongoing security support.

Connecting the Dots

In this field, AAMI TIR57 is more than a guideline. It is a framework for securing medical devices and protecting patient safety. By applying these principles in your services, Blue Goat Cyber can position itself as a knowledgeable provider of medical device security.

Understanding and applying AAMI TIR57 can also help when speaking with cybersecurity decision-makers in healthcare. They want partners who understand both cybersecurity and the specific risks tied to medical devices.

What is a Cybersecurity Bill of Materials (CBOM)?

A Cybersecurity Bill of Materials (CBOM) is an essential requirement enforced by the FDA from March 29, 2023, onward for medical devices. It requires medical device manufacturers to provide a comprehensive and accurate list of software and hardware components used in their devices, including any third-party software and open source components. This list, known as the CBOM, serves as a self-attestation by manufacturers, indicating the accuracy and completeness of the components used in their medical devices. One critical aspect of the CBOM is the inclusion of a Software Bill of Materials (SBOM), which ensures transparency regarding software components used in medical devices. Given the critical nature of medical devices and the cybersecurity risks involved, a comprehensive and accurate SBOM is especially important for maintaining device security and integrity.

How can Blue Goat help in generating accurate SBOMs?

Blue Goat has a long-standing record of providing reliable and precise Software Bill of Materials (SBOMs) for its clients for over ten years. We have developed sophisticated tools that let us identify components accurately, even at the snippet level. With our advanced string search algorithms, we can detect all third-party and commercial components. In addition, Blue Goat offers a comprehensive SBOM-as-a-service solution, which ensures that clients receive complete and accurate SBOMs in standard formats such as SPDX and CDX that comply with the FDA's requirements. Blue Goat can also validate internally generated SBOMs or those created by software supply chain partners, helping ensure alignment with FDA regulations. By using our expertise and tools, Blue Goat can help organizations generate reliable and accurate SBOMs.

What's the difference in a CBOM and SBOM?

The terms "Cybersecurity Bill of Materials" (CBOM) and "Software Bill of Materials" (SBOM) are related concepts in cybersecurity and software management, often used to improve transparency and security in software products and systems, including medical devices. The main difference is scope:

1. Software Bill of Materials (SBOM): An SBOM is a detailed inventory of all components, libraries, and modules that make up a piece of software, including both open-source and proprietary elements. Its main purpose is to give users-including end-users, developers, and security professionals-a clear understanding of what software is running in their environment. This transparency supports vulnerability management, license management, and security analysis, helping users identify security risks, meet licensing obligations, and manage patches effectively.

See also: Embedded Cybersecurity Challenges in Medical Devices, IVD Medical Device Cybersecurity Concerns, and MedTech Augmented Reality Cybersecurity.

2. Cybersecurity Bill of Materials (CBOM): A CBOM extends the SBOM concept by including not only software components but also hardware components, network dependencies, and any other elements needed to understand the cybersecurity posture of a device or system. The CBOM is especially relevant where the security of the full ecosystem, including physical components and network interactions, matters. For example, understanding the full set of components and dependencies in medical devices or industrial control systems is important for assessing vulnerabilities, attack paths, and overall system security.

In short, an SBOM focuses on software components, while a CBOM covers the broader set of elements tied to cybersecurity. Both improve security and manageability, but from different angles. Adoption of SBOMs and CBOMs is encouraged by multiple cybersecurity frameworks and standards to promote transparency and support better risk management.

What is the significance of SBOMs and SPDX in the present and future?

March 29, 2023, marked a major point when the FDA began enforcing cybersecurity requirements for medical devices, requiring manufacturers to comply with a Cybersecurity Bill of Materials (CBOM). A key part of the CBOM is the Software Bill of Materials (SBOM), which lists the software and hardware components used within medical devices. This includes internally developed software as well as third-party and open-source components.

SBOMs matter because they improve transparency and accountability in the medical device supply chain. By requiring manufacturers to self-attest to the accuracy of their SBOMs, regulators can get a fuller view of the components used to build these devices. That supports better assessment and management of security vulnerabilities.

One recognized standard for SBOMs is the Software Package Data Exchange (SPDX) format. SPDX provides a standardized way to document and share SBOMs, making communication easier among manufacturers, regulators, healthcare providers, and consumers. This common format supports interoperability and simplifies review by making comparison and analysis easier.

SBOMs and SPDX matter now and going forward because they strengthen cybersecurity practices and increase transparency across industries, not just in healthcare. As noted by the National Telecommunications and Information Administration (NTIA), SBOM use should extend beyond medical devices and become standard practice in other sectors as well. That reflects a broader recognition that organizations need to understand and manage the software components in connected systems.

As SBOM rules are enforced, companies across industries are working to create compliant SBOMs, and some are turning to third-party providers that specialize in generating accurate SBOMs. These providers, like Synopsys, offer tools and solutions that can precisely identify software components, including third-party and commercial components. They can also help ensure that generated SBOMs align with the requirements set by regulators such as the FDA.

What are the additional elements required by the FDA for an SBOM?

The FDA has established additional requirements for a Software Bill of Materials (SBOM) for medical devices. Beyond the minimum elements defined by the National Telecommunications and Information Administration (NTIA), the FDA requires specific information. These additional elements include the support level, support end date, and known security vulnerabilities of the software components used in the medical devices.

While open source projects may not have designated support levels or support end dates, these additional elements largely apply to third-party or commercial components integrated within the medical device application. Complete and accurate SBOMs are important because they improve transparency and support cybersecurity.

How can Blue Goat Cyber help ensure that medical device software complies with required standards and regulations?

Blue Goat understands the need for compliance in medical device software. Our team is experienced in the security process and helps protect organizations from costly and dangerous attacks. With years of experience across multiple testing types, we can address the specific requirements of your device.

We also take compliance seriously. Our team can guide you through the regulatory environment, including the guidelines set by the FDA. We understand the importance of timely product releases, and our experience helps you move through the required steps to meet applicable standards and regulations.

With Blue Goat supporting you, your medical device software can meet required compliance standards and support confidence in the safety and effectiveness of your product.

What tools does Blue Goat use for testing software for medical devices?

Blue Goat Cyber uses a combination of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) for medical device software testing. SAST analyzes source code to identify vulnerabilities, while DAST tests the running application to find security issues. Both methods are critical for securing medical devices, which handle sensitive data and are subject to strict FDA regulations and HIPAA guidelines. Blue Goat Cyber's approach addresses concerns unique to medical devices, such as compliance with changing security standards and protection of critical patient information.

In addition to SAST and DAST, Blue Goat Cyber also uses penetration testing and vulnerability assessment tools for comprehensive medical device software testing. Penetration testing tools simulate real-world attacks to identify possible security breaches, while vulnerability testing tools scan systematically for known vulnerabilities. Together, these methods provide a strong framework for helping ensure the security and compliance of medical devices while addressing issues such as critical functionality, data sensitivity, and regulatory standards like FDA clearance and HIPAA compliance​.

What is some background on medical device vulnerabilities?

Over the past few years, the Internet of Things (IoT), combined with the widespread use of Information Technology, has created a growing attack surface where rapid product development and new features often take priority over security. For example, attackers once disrupted most U.S. internet activity using 61 default IoT usernames and passwords. Consumers did not change them before activating their devices, effectively turning those devices into part of one of the largest Distributed Denial of Service (DDoS) attacks in history.

The healthcare industry is rapidly adopting IoT devices, often called the Internet of Medical Things (IoMT), to improve patient safety and support healthcare workers in treatment delivery. From medication administration to remote sensor monitoring, embedded medical devices are improving care quality and increasing interaction with providers. But when security is missing in product design, those weaknesses can turn into real-world attacks with serious consequences.

Those consequences became clear in 2017 when researchers acquired equipment costing from $15 - $3,000 and intercepted the radio frequencies from cardiac devices. They were able to reprogram the devices to modify a patient’s heartbeat and drain the internal battery. As a result, the FDA recalled almost 500,000 pacemakers and required in-person firmware updates. Researchers have shown similar capabilities with infusion pumps and MRI systems.

Non-networked medical devices may carry even higher risk. Easy physical access and the availability of RFID cloners contribute to weak physical security. In 2018, researchers showed they could emulate and alter a patient’s vital signs in real time using an electrocardiogram simulator bought on eBay for $100.

In late 2018, the Department of Health and Human Services Office of the Inspector General (IG) criticized FDA procedures for assessing post-market cybersecurity risk in medical devices. To strengthen the FDA's core mission “to ensure there is a reasonable assurance that medical devices legally marketed in the United States are safe and effective for their intended uses,” they described ongoing efforts to improve medical device security.

According to the FDA, “Healthcare Delivery Organizations (HDOs) are responsible for implementing devices on their networks and may need to patch or change devices and/or supporting infrastructure to reduce security risks. Recognizing that changes require a risk assessment, the FDA recommends working closely with medical device manufacturers to communicate necessary changes.”

Blue Goat can help HDOs transfer that risk by evaluating the cybersecurity posture on your wired or wireless medical devices.

Contact us today and inquire about our full-range penetration testing.

We can significantly increase your patient’s safety while reducing your organization’s risk.

What are some reasons for the lack of security in many medical devices?

The lack of security in many medical devices comes from several factors. One is increased scrutiny of device vulnerabilities, which forced regulators like the FDA to reassess cybersecurity requirements. An FBI report found that 53% of digital medical devices and internet-connected products had critical vulnerabilities, exposing patients and providers to serious risk. Many of those weaknesses were found in unpatched and outdated devices, which often become the weakest link in the security chain. Research also suggests that 88% of healthcare cyberattacks involved an IoMT device, which highlights the need for stronger security controls.

Weak security controls have been a long-running problem. Many devices were designed primarily for medical function, with security added later or not at all. These bolted-on controls have proved inadequate, leaving weaknesses attackers can exploit. In the past, the lack of mandatory requirements and accountability also contributed to the problem. Recent regulatory changes and the risk of costly penalties have made clear that ignoring security is no longer acceptable.

What is the purpose of the new cybersecurity regulations implemented by the FDA?

The FDA's new cybersecurity regulations were put in place to improve the security of medical devices. Section 524B (c) defines a device that falls within the scope of these requirements. Under this section, a device is covered if it includes software that is validated, installed, or authorized by the sponsor of the device or within it. The device must also be able to connect to the internet and have technological characteristics that are validated, installed, or authorized by the sponsor. This definition reflects the fact that these devices can be vulnerable to cyber threats. The purpose of these regulations is to address those vulnerabilities and create greater accountability for medical device manufacturers. By requiring compliance and introducing potentially costly penalties for non-compliance, the FDA aims to make these regulations have a real effect on medical device security. This move toward accountability marks a shift away from the old voluntary compliance model.

What testing needs can Blue Goat Cyber cover?

Blue Goat Cyber can cover a wide range of testing needs. Our expertise includes penetration testing, network penetration testing, web application penetration testing, API penetration testing, HIPAA penetration testing, SOC 2 penetration testing, PCI penetration testing, application penetration testing, internal penetration testing, black box penetration testing, gray box penetration testing, white box penetration testing, and mobile application penetration testing.

We also offer specialized services for medical device software. Our healthcare testing professionals verify medical device software requirements and perform testing at the API, integration, and system levels. With a focus on security, we help ensure software architecture can withstand attack.

To improve the reliability and security of medical device software, our team performs software code review and code analysis. We also conduct user acceptance testing to confirm the software meets the usability needs of healthcare professionals and end-users.

Our compliance experts, including FDA and HIPAA specialists, work with clients to help ensure medical device software meets required standards and regulations. With detailed reporting and test documentation aligned with ISO 13485 and ISO/IEC/IEEE 29119-3:2021, we provide transparency into testing activities.

In addition to healthcare and medical device software testing, we offer medical device cybersecurity, cyber threat awareness training, enterprise cybersecurity audit, static application security testing (SAST), dynamic application security testing (DAST), vulnerability assessment services, CISO-as-a-Service, physical security assessment, phishing services, and HIPAA security risk analysis (HIPAA SRA).

At Blue Goat Cyber, we focus on meeting diverse testing needs with comprehensive and reliable solutions. Our goal is to help ensure your software and systems are secure and compliant.

How can Blue Goat help organizations protect their assets and networks and produce safer medical devices?

Blue Goat offers services that help organizations protect assets and networks while supporting the development of safer medical devices. Organizations that work with Blue Goat can build a stronger security testing program with access to a broad range of services and expertise.

Through our cybersecurity experience, Blue Goat can assess current security measures, identify vulnerabilities and risks in network infrastructure, and recommend strategies to improve overall security posture. Putting those measures in place helps organizations better protect assets and networks from cyber threats.

Blue Goat also provides healthcare-specific guidance to support safer medical device development. We understand the security challenges medical device manufacturers face and can provide tailored solutions to reduce those risks. Our experience in medical device security can help organizations work toward FDA regulatory compliance requirements and industry best practices, lowering the chance of device vulnerabilities and data breaches.

What is the FDA's new requirement for connected medical devices?

The FDA introduced a new requirement for connected medical devices that took effect on March 29, 2023. The requirement focuses on cybersecurity and is intended to improve the safety and security of these devices. One component is the implementation of a Cybersecurity Bill of Materials (CBOM).

Under the CBOM, manufacturers of medical devices must attest to the accuracy of a comprehensive list of software and hardware components used in their devices. This list must include components developed by the manufacturer as well as any third-party software and open-source components incorporated into the device.

The FDA specifically emphasizes the importance of a Software Bill of Materials (SBOM) within the CBOM framework. An SBOM is essential for connected medical devices because it provides a complete and accurate inventory of all software components used. It supports better tracking of vulnerabilities and helps improve response and mitigation when cybersecurity incidents occur.

By enforcing this requirement, the FDA aims to ensure that manufacturers prioritize cybersecurity in the development and maintenance of connected medical devices. The goal is to improve the overall safety and security of these devices for healthcare professionals and patients.

How can cybersecurity vulnerabilities in medical devices lead to patient data breaches?

Patient Monitors: Devices that monitor vital signs such as heart rate and blood pressure are vulnerable to data interception and manipulation, which creates a serious risk to patient data security. Attackers can exploit these weaknesses to intercept and alter collected data. That can lead to misdiagnosis or delayed treatment, putting patients at risk.

MRI Machines: MRI machines are central to diagnostic imaging, but they are also exposed to cybersecurity threats. Attacks against these systems can disrupt operation, leading to incorrect imaging data or complete operational failure. That can directly affect diagnosis and treatment planning.

Radiation Therapy Systems: If radiation therapy systems are hacked, patient safety is at serious risk. Unauthorized access to controls can result in incorrect radiation doses. That may mean too little radiation for effective treatment or dangerously high doses that cause harm.

Diagnostic and Imaging Equipment: Medical equipment such as CT scanners and ultrasound machines can also be compromised. If that happens, they may produce false diagnostic information, which can lead to incorrect treatment decisions, delayed care, or unnecessary procedures.

Surgical Robots: Surgical robots depend on precise controls, which makes them vulnerable to cyberattacks. Unauthorized access or manipulation can result in loss of control or altered movements during surgery. That can lead to surgical errors and patient harm.

Defibrillators: External defibrillators are life-saving devices used in emergencies, but they are also vulnerable to attack. A cyberattack could disrupt shocks or drain batteries, making the device ineffective in a critical moment.

Hospital Networking Equipment: While not directly used in care, hospital networks support all connected medical devices. A network breach can affect device function and lead to loss of patient data. Because healthcare systems are interconnected, the impact can spread quickly across the environment.

These vulnerabilities show why healthcare needs stronger cybersecurity measures and safeguards. Up-to-date software, encryption, and strong password security are basic controls needed to protect patient data and keep medical devices operating safely.

What are the consequences of cyberattacks on medical devices?

Cyberattacks on medical devices can directly affect patient safety and healthcare institutions. Interference with device operations can lead to incorrect treatment and serious health risks. These incidents create immediate danger and also reduce trust in the reliability of medical devices and healthcare organizations.

Recovery is often expensive and slow. It may involve device recalls, software upgrades, and legal consequences. Those steps are necessary to address the weaknesses exploited in the attack and prevent further incidents. Healthcare institutions need strong cybersecurity measures to protect networked medical devices and patient health.

There is also the risk of attackers gaining remote control of devices. That access could let them manipulate settings, deliver incorrect medication doses, or disrupt life-support functions. The consequences can be life-threatening, which is why stronger cybersecurity measures are necessary.

The medical profession needs to treat the security of networked medical devices as a priority. Reducing the risk of cyberattacks, preserving device integrity, and maintaining patient trust all depend on it.

What are networked medical devices and why is cybersecurity important for them?

Networked medical devices are interconnected devices used in healthcare settings that rely on wireless technologies. These devices support patient care, including insulin pumps, pacemakers, infusion pumps, patient monitors, MRI machines, and more. They allow doctors and healthcare professionals to monitor and manage patients remotely, improving efficiency and enabling less invasive procedures.

But that same connectivity creates cybersecurity risk. When networked medical devices are compromised, hackers can target them in ways that threaten patient safety and can lead to serious harm or death. Several high-profile cases have shown why stronger cybersecurity in healthcare technology is necessary.

For example, insulin pumps have been manipulated remotely, creating the risk of insulin overdose. Pacemakers, which regulate heart rhythms, have had vulnerabilities that attackers could exploit to alter heart rhythms or drain the battery. The WannaCry ransomware attack on the UK's National Health Service showed how cyberattacks on hospital networks can indirectly affect patient care and safety.

These examples show why healthcare providers need stronger security protocols, regular software updates, and close monitoring. Those measures help protect patient safety and support the reliability of essential networked medical devices.

What recommendations are given to prevent medjacking and secure networked devices?

To prevent medjacking and improve the security of networked devices, the following recommendations are provided:

1. Promptly address existing devices: Take immediate action to remediate any potential infections on your networked devices.

2. Swiftly implement software/hardware fixes: Develop a strategic plan to efficiently integrate and deploy the necessary updates and fixes provided by medical device manufacturers.

3. Seek expert consultation: Engage competent HIPAA consultants to evaluate and assess your compliance program, providing on-site guidance and expertise. If needed, request a quote for a thorough HIPAA audit.

4. Prioritize cybersecurity-minded vendors: Evaluate medical device vendors based on their commitment to cybersecurity. Choose vendors that allow you to modify passwords, offer regular updates, and are willing to conduct quarterly reviews with you.

5. Manage device access: Implement strict access control measures, particularly through USB ports. Consider utilizing one-way memory sticks to prevent the spread of infections among similar devices.

6. Establish secure network zones: Isolate devices within dedicated, secure network zones. Protect them further by implementing an internal firewall that only permits access to specific services and authorized IP addresses.

7. Address end-of-life for medical devices: Regularly assess the efficacy and longevity of your medical devices. Dispose of devices that are no longer supported by manufacturers or are unable to handle malware effectively. Prior to disposal, ensure the secure wiping or destruction of any patient data stored on the devices.

Following these recommendations can reduce the risk of medjacking and improve the security of networked devices.

Why don't traditional cyber defense tools work with medical devices?

Traditional cyber defense tools are often not compatible with network-connected medical devices for several reasons. First, these devices often lack the infrastructure needed to support installation and operation of security tools. Unlike standard computers or mobile devices, medical devices may have limited processing power, memory, and storage. That makes it impractical, and sometimes impossible, to run resource-intensive security software on them.

Applying software modifications can also be treated as tampering and may affect compliance with regulations set by the FDA. The FDA has stressed the need for manufacturers to implement adequate security measures, but limits on device modification make post-production security improvements difficult.

Traditional security tools are also usually built for more conventional systems and networks. They may not be designed to detect or address the specific vulnerabilities found in medical devices. As a result, they may fail to identify or mitigate device-specific threats.

Given the critical nature of medical devices and the risk created by cybersecurity breaches, manufacturers need to build appropriate security controls directly into device design and production. That helps ensure devices are secure from the start and aligned with FDA regulations.

Who is responsible for maintaining security within medical devices?

Manufacturers are responsible for maintaining security within medical devices. The FDA states that manufacturers are required to remain diligent in identifying and addressing risks and hazards associated with their devices, including cybersecurity risks. However, not all manufacturers take this responsibility seriously.

What types of medical devices are at the highest risk of being hacked?

The medical devices at greatest risk of hacking are stationary devices. While the idea of implanted devices being hacked is alarming, cybercriminals are usually motivated by financial gain rather than terrorism. They often target stationary devices because those systems offer the best opportunity to steal large amounts of patient data.

What is medjacking and how does it pose a threat to healthcare organizations?

Medjacking, or medical device hijacking, is a serious cybersecurity threat to healthcare organizations. It happens when hackers compromise networked medical devices, including consumer health monitoring devices, wearables, embedded devices, and stationary devices connected to the internet.

One main reason medjacking is dangerous is the patient health data these devices store. Stationary devices such as x-ray scanners and chemotherapy dispensing stations are especially attractive targets because they hold sensitive information that attackers can exploit. Medical data is often worth more on the black market than credit card data.

A major cause of these risks is that manufacturers have not always treated security as a priority. Many devices lack built-in security controls, which makes them easier to attack. The limited use of cyber defense tools with medical devices makes the problem worse.

The government has also not always taken strong action against manufacturers or enforced strict security controls. That lack of pressure has left healthcare organizations more exposed to medjacking.

Another challenge is patching vulnerabilities in devices that are constantly in use. Healthcare organizations depend on these systems for critical functions and may have operational constraints that make updates difficult.

The consequences of medjacking can be severe. Healthcare organizations may violate HIPAA requirements and face legal and financial penalties. Data breaches tied to medjacking also put patient privacy and confidentiality at risk.

To reduce the threat, healthcare organizations should take proactive steps. These include remediating infected devices, obtaining fixes and updates from manufacturers, consulting HIPAA experts, evaluating vendors for cybersecurity maturity, managing device access, isolating devices in secure network zones, and disposing of outdated devices properly.

What is medical device software testing?

Medical device software testing is a critical process that helps ensure software embedded within or designed to control medical devices works accurately, reliably, and in compliance with regulatory standards. This testing verifies that the software meets intended functionality, user interface, integration, and performance requirements under medical device regulations such as the FDA's 21 CFR Part 11 and the internationally recognized IEC 62304 standard. The objective is broad: remove defects in software architecture and code, meet strict regulatory requirements, and help produce safe medical devices.

Key components of medical device software testing include:

• Functional Testing: This evaluates the software's operational behavior to ensure it performs its intended functions correctly. It involves detailed testing of the software's features and capabilities.

• Device Verification Testing: It verifies that the device as a whole, including its software, meets all specified requirements. This testing ensures that the product is designed correctly and works as expected.

• Security Testing: Given the sensitivity of medical data and the impact of cybersecurity threats, testing for security vulnerabilities is essential. It helps identify and mitigate security risks.

• Interoperability Testing: This ensures that the medical device can operate safely and compatibly with other systems or devices. It is especially important for devices that are part of a broader medical ecosystem.

• Usability Testing: Focused on human-device interaction, usability testing helps ensure that the device can be used efficiently, effectively, and satisfactorily by intended users.

• Performance Testing: This assesses the software's stability, speed, and scalability under different conditions. It helps ensure the software can handle its intended workload without failure.

• Compliance Testing: This ensures the software meets all relevant regulatory and industry standards, with a focus on safety, quality, and reliability requirements specific to medical devices.

Medical device software testing follows a rigorous methodology that includes planning, requirement analysis, test case development, test execution, and detailed documentation throughout the cycle. This process is designed to identify and address defects or anomalies in software architecture, code, or performance before the device reaches the market, helping ensure safety and efficacy. The work typically combines automated and manual testing and requires a deep understanding of both technical and regulatory aspects of medical device development.

What are common medical device vulnerabilities?

Common medical device vulnerabilities include a range of issues that can compromise the safety, privacy, and effectiveness of medical devices. These vulnerabilities are often tied to software flaws, outdated operating systems, or insecure interfaces that attackers can exploit to gain unauthorized access, steal sensitive data, or disrupt device functionality. Common examples include:

• Insecure Network Connections: Many medical devices connect to healthcare networks through Wi-Fi or Bluetooth, making them vulnerable to eavesdropping or unauthorized access if not properly secured.
• Outdated Software and Firmware: Devices running outdated software or firmware are exposed to known exploits that have not been patched. This includes operating systems no longer supported by vendors.
• Weak Authentication and Authorization Controls: Poor authentication mechanisms can let unauthorized users access medical devices, which can lead to misuse or alteration of critical healthcare information.
• Lack of Encryption: Failure to encrypt sensitive data at rest and in transit can expose protected health information (PHI) and other confidential data to interception and misuse.
• Third-Party Software Components: Vulnerable third-party software components can introduce additional risk, especially when device manufacturers do not regularly update or patch them.
• Configuration and Customization Errors: Improper configuration or customization can leave devices exposed. Examples include unchanged default passwords or disabled security features.
• Physical Security: Physical access can also create risk, especially if devices are not adequately protected within the facility and can be tampered with or stolen.

Addressing these vulnerabilities requires a broad cybersecurity strategy that includes regular updates and patches, strong encryption, solid authentication and authorization controls, and vigilant network monitoring. Ongoing collaboration between device manufacturers, healthcare providers, and cybersecurity professionals is also necessary to keep medical devices protected against new threats.

FAQ

What is RFID in the context of medical devices?

RFID (Radio Frequency Identification) in medical devices uses radio waves to identify and track equipment. It involves tags attached to devices, readers, and a backend system to manage data, enhancing security and operational efficiency.

How does RFID enhance medical device cybersecurity?

RFID improves cybersecurity by providing unique device authentication, enabling secure communication channels, and supporting real-time monitoring for tampering detection. It also aids in inventory management, reducing theft and loss of critical devices.

What are the limitations of using RFID for cybersecurity?

Limitations include potential signal interference, which can affect accuracy, and the significant initial cost of implementing RFID infrastructure. Interoperability with existing IT systems and electronic health records also presents a challenge.

Does the FDA require RFID in medical devices?

The FDA does not mandate RFID use, but its February 3, 2026 final guidance on cybersecurity emphasizes secure product development, threat modeling, and post-market vulnerability management. RFID can support these requirements by enhancing device security and traceability.

How can RFID technology evolve in medical device security?

Future developments include smaller, more durable tags, improved range, and stronger encryption. Integrating RFID with blockchain technology could also create more transparent and secure data management for medical devices.

What types of medical devices use RFID?

RFID is used in various medical devices such as implantable devices, drug delivery systems, surgical instruments, and hospital beds. This enables real-time tracking, inventory management, and authentication for patient safety and operational efficiency.

About the author

Christian Espinosa, CISSP, Founder, Blue Goat Cyber. Christian leads a team focused exclusively on medical device cybersecurity for FDA premarket submissions and postmarket compliance. Read more about Christian.