The House Energy and Commerce Oversight and Investigations Subcommittee April 1 discussed cybersecurity threats in legacy medical devices during a hearing. The subcommittee heard from experts on the dangers of outdated devices as the hardware can last several years longer than software.

“Our patients depend on millions of medical devices — many of them aging, machines — to deliver life-saving care,” said Christian Dameff, M.D., emergency physician and co-director for the Center for Healthcare Cybersecurity at the University of California San Diego Health. “The cybersecurity of our legacy medical devices thus becomes a literal matter of life and death."

Erik Decker, vice president, chief information security officer at Intermountain Health, discussed the current state of cyberthreat adversaries as well as the state of medical device security programs.

“The primary concerns with attacks against medical devices are related to patient safety and national security,” Decker said. “Additionally, they can be used for conduits for further attack against an organization. Though there have been no known public attacks against medical devices to cause harm to a patient, the studies and research have shown that such an attack is possible.”

Other witnesses for the hearing included Greg Garcia, executive director of the Health Sector Coordinating Council Cybersecurity Working Group; Michelle Jump, chief executive officer of MedSec; and Kevin Fu, professor from the department of electrical and computer engineering at the Khoury College of Computer Sciences at Northeastern University.

Related News Articles

Headline
The FBI’s Internet Criminal Complaint Center May 15 released an alert warning of a malicious text and voice messaging campaign involving impersonators…
Headline
In his latest AHA Cyber Intel blog, John Riggi, AHA national advisor for cybersecurity and risk, examines the state of cyber and physical threats in 2025 as…
Headline
Health care had more cyberthreats last year than any other critical infrastructure industry, according to the FBI's 2024 Internet Crime Report released April…
Headline
The National Security Agency April 23 released a report on operational technology systems that includes recommendations for security policies and technical…
Chairperson's File
Public
Cybersecurity and physical threats are unfortunately significant enterprise risks for health care, regardless of size or location. Every hospital, physician…
Headline
The Cybersecurity and Infrastructure Security Agency April 17 released guidance to reduce risks associated with a reported breach of Oracle cloud services.…