A guide published Jan. 13 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI, Environmental Protection Agency, Transportation Security Administration and international agencies provides considerations for organizations to select and secure operational technology products. The guide suggests owners select products from manufacturers prioritizing security elements such as configuration management, logging in the baseline product, open standards, ownership, protection of data and more.  

"Many hospitals have vast quantities of network-connected OT devices such as cameras, door access controls and HVAC systems," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Keeping these devices secure and operational is critical to the delivery of high-quality patient care. When making purchasing decisions for new technology, hospitals should demand these security standards be part of the product.

“This is also a good reminder to look at the legacy technology in your networks and apply as many of these principles as possible. If legacy equipment cannot be brought up to these standards, understand the vulnerabilities in those systems and have a plan to segment and monitor the devices.

“More importantly, hospitals and health systems should understand the clinical and business impact which may result from a loss of OT due to a loss of network connectivity during a cybersecurity event. It is strongly recommended that health care organizations maintain business and clinical continuity plans to compensate for a loss of OT for 30 days or longer." 
 
For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity

Related News Articles

Headline
The AHA is advising hospitals and health systems to be alert for potential scam calls where actors are impersonating Drug Enforcement Agency agents. An AHA…
Headline
The Cybersecurity and Infrastructure Security Agency and Food and Drug Administration Jan. 30 released notices warning of vulnerabilities found in the Contec…
Headline
The AHA yesterday released an advisory alerting members that the association and the Health Information Sharing and Analysis Center have identified attempted…
Headline
The ransomware attack last year against UnitedHealth Group subsidiary Change Healthcare exposed data of more than 190 million people — up from previous reports…
Headline
The Cybersecurity and Infrastructure Security Agency and FBI Jan. 22 released an advisory explaining how cyberthreat actors “chained” vulnerabilities —…
Headline
In the latest issue of AHA's Trustee Insights newsletter, James Liggins, Jr., 2025 AHA Committee on Governance chair and board chair of Bronson Healthcare…